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MEMORANDUM  FOR  DIRECTOR,  DEFENSE  COMMISSARY  AGENCY 

SUBJECT:  Audit  Report  on  Controls  Over  Vendor  Payment 

Authorizations  by  the  Defense  Commissary  Agency 
(Report  No.  93-135) 


We  are  providing  this  final  report  for  your  information  and 
use,  as  part  of  our  audit  of  the  FY  1992  Resale  Stock  Fund 
Financial  Statements.  It  addresses  issues  related  to  the 
adequacy  of  controls  over  processing  vendor  payments  that  could 
impair  the  Defense  Commissary  Agency's  (DeCA)  ability  to  develop 
reliable  information  needed  to  prepare  the  FY  1992  Resale  Stock 
Fund  financial  statements.  This  report  addresses  completed  audit 
results  based  on  a  statistical  sample  of  vendor  payments  made 
during  the  first  half  of  FY  1992.  Many  of  the  issues  noted  in 
this  report  were  previously  identified  in  memorandums  and  a 
quick-reaction  report  to  the  Director,  and  action  has  been  taken 
or  is  ongoing  to  correct  the  identified  problems.  Therefore,  the 
recommendations  in  this  report  address  only  those  issues  where 
further  action  is  necessary  to  improve  internal  controls  over 
vendor  payments.  We  have  considered  your  comments  in  preparing 
this  final  report. 

DoD  Directive  7650.3  requires  that  all  audit  recommendations 
be  resolved  promptly.  Therefore,  we  request  that  DeCA  provide 
final  comments  on  the  unresolved  recommendations  and  the 
estimated  monetary  benefits.  Recommendations  and  potential 
monetary  benefits  are  subject  to  resolution  in  accordance  with 
DoD  Directive  7650.3  in  the  event  of  nonconcurrence  or  failure  to 
comment.  We  request  final  comments  by  July  30,  1993. 

The  courtesies  extended  to  the  audit  staff  are  appreciated. 
If  you  have  any  questions  on  this  audit,  please  contact 
Mr.  Robert  Ryan  at  (703)  692-3457  (DSN  222-3457)  or  Mr.  Walter 
Loder  at  (703)  692-3387  (DSN  222-3387).  The  planned  distribution 
of  this  report  is  listed  in  Appendix  D. 


Robert  u.  Lieberman 
Assistant  Inspector  General 
for  Auditing 
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CONTROLS  OVER  VENDOR  PAYMENT 
AUTHORIZATIONS  BY  THE  DEFENSE  COMMISSARY  AGENCY 


EXECUTIVE  SUMMARY 


Introduction.  On  October  1,  1991,  the  Defense  Commissary  Agency 
(DeCA)  was  established  through  the  consolidation  of  Army,  Navy, 
Air  Force,  and  Marine  Corps  commissary  systems.  The  Office  of 
the  Secretary  of  Defense  centralized  commissary  management  under 
one  Defense  agency  to  reduce  DoD  cost  of  operating  the  commissary 
system.  A  key  decision  was  to  achieve  the  consolidation  without 
gradually  phasing  in  different  commissary  store  systems.  DeCA 
manages  384  commissary  stores  worldwide,  and  employs  about 
2  3,000  workers.  Sales  were  $6.1  billion  in  FY  1992  and  are 
estimated  at  $6.0  billion  for  FY  1993. 

Objectives.  The  principal  objective  of  our  audit  was  to 
determine  whether  financial  statement  accounts  affected  by  vendor 
payments  and  managed  under  DeCA's  Standard  Automated  Voucher 
Examination  System  (SAVES)  present  fairly  the  financial  position 
for  these  accounts.  We  also  examined  the  adequacy  of  internal 
controls  to  ensure  compliance  with  laws  and  regulations  that  have 
a  material  impact  on  the  accounts  affected  by  vendor  payments. 

Audit  Results.  Based  on  a  sample  from  $1.6  billion  in  CONUS  only 
vendor  payments  in  the  first  half  of  FY  1992,  DeCA  management  did 
not  provide  adequate  internal  controls  over  vendor  payment 
transactions.  Specifically: 

o  DeCA's  vendor  payment  process  lacked  the  internal 
controls  necessary  to  ensure  that  all  payment  authorizations  for 
vendor  invoices  were  authorized,  valid,  and  accurate.  As  a 
result,  DeCA  authorized  disbursements  of  $404  million  without 
proper  supporting  documentation,  paid  $11  million  in  duplicate 
vendor  payments  and  entered  another  $191  million  in  duplicate 
invoices  into  the  bill  paying  system  (SAVES).  For  FY  1992,  we 
identified  potential  duplicate  payments  of  up  to  $17  million 
(Finding  A) . 

o  DeCA  did  not  adhere  to  the  requirements  of  the  Prompt 
Payment  Act  and  Office  of  Management  and  Budget  Circular  A-125, 
"Prompt  Payment."  As  a  result,  DeCA  paid  almost  $6  million  in 
interest  and  sustained  $2.9  million  in  lost  discounts  in  FY  1992. 
Additionally,  we  project  that  DeCA  underpaid  about  $2.4  million 
in  interest  to  vendors  during  the  first  half  of  FY  1992. 
(Finding  B) . 


Internal  Controls.  Internal  controls  were  not  effective  to 
ensure  that  vendor  payments  were  made  only  with  the  proper 
invoices,  evidence  of  delivery,  and  a  valid  contract.  See 
Findings  A  and  B  for  details  on  these  material  weaknesses  and 
Part  I  for  a  description  of  the  controls  assessed. 

Potential  Benefits  of  Audit.  We  identified  monetary  benefits  of 
up  to  $2  08  million.  Of  the  $208  million,  DeCA  took  action  to 
avoid  duplicate  payments  of  $191  million.  The  remaining 
$17  million  in  duplicate  payments  could  still  be  recouped  (see 
Appendix  B) . 

Summary  of  Recommendations.  We  recommended  that  DeCA  obtain 
documentation  on  the  SAVES,  provide  additional  edit  checks  on 
bill  paying,  move  financial  functions  under  the  operational 
control  of  the  Director,  Resource  Management,  prepare  and  execute 
a  written  bill  paying  plan  to  exercise  quality  control  over  bill 
paying,  and  evaluate  employees  on  internal  controls 
implementation.  We  also  recommended  controls  to  ensure  that 
service  center  personnel  meet  the  Prompt  Payment  Act 
requirements . 

Management  Comments.  The  Director,  DeCA  was  responsive  to  most 
of  the  draft  report  recommendations.  However,  the  Director  did 
not  address  the  need  for  additional  edit  checks.  Additionally, 
although  DeCA  concurred  with  the  need  for  and  stated  that  several 
directives  had  been  issued  to  improve  and  test  the  software  in 
its  bill  paying  system,  DeCA  did  not  address  the  need  to  prepare 
and  execute  a  written  bill  paying  plan  to  exercise  quality 
control  by  testing  the  implementation  of  the  bill  paying  system 
by  service  center  personnel.  Further,  the  Director  did  not  agree 
with  the  amount  of  projected  duplicate  payments  and  $191  million 
in  funds  put  to  better  use.  A  full  discussion  of  management 
comments  and  audit  responses  is  in  Part  II  and  Part  IV  of  this 
report.  The  full  text  of  management  comments  is  also  in  Part  IV. 

Audit  Response.  We  request  that  DeCA  reconsider  its  position  and 
respond  to  the  unresolved  recommendations  and  potential  monetary 
benefits  in  response  to  the  final  report  by  July  30,  1993. 
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PART  I  -  INTRODUCTION 


Background 

The  Defense  Commissary  Agency  (DeCA)  was  established  on 
October  1,  1991.  DeCA  was  formed  by  consolidating  the  commissary 
systems  in  the  Army,  Navy,  Air  Force,  and  Marine  Corps  under  one 
Defense  agency.  The  Jones  Commission  recommended  the 
consolidation  and  Defense  Management  Review  Decision  972  provided 
for  the  transfer  of  budgetary  resources. 

DeCA  centralized  the  management  of  commissaries  under  a  director 
who  reports  directly  to  the  Assistant  Secretary  of  Defense 
(Production  and  Logistics) .  The  decision  was  made  to  totally 
consolidate  the  commissaries  on  October  1,  1991,  rather  than 
gradually  phasing  in  the  different  commissary  store  systems. 

DeCA  is  responsible  for  managing  DoD's  commissary  system.  DeCA 
operates  DoD  commissaries  worldwide,  provides  troop  issue 
subsistence  for  the  Air  Force  and  the  Army  at  selected  locations, 
and  programs  the  replacement  of  war  reserve  materiel  rotation 
rations  for  the  Air  Force,  DeCA  manages  384  commissary  stores 
worldwide  and  employs  about  23,000  workers.  Commissary  sales  for 
FY  1992  were  $6.1  billion  and  are  estimated  at  $6.0  billion  for 
FY  1993. 

Commissary  operations  are  financed  by  direct  appropriation.  The 
amount  requested  for  appropriated  funding  is  equal  to  the 
estimated  total  expenses  required  for  support  of  commissary 
operations  in  each  fiscal  year.  The  three  sources  of  funds  for 
DeCA  are  the  resale  stock  fund,  the  commissary  surcharge 
collections  fund,  and  operations  and  maintenance  funds  of  DoD. 
These  funds  are  subject  to  apportionment  controls  and  to  all  laws 
and  regulations  pertaining  to  appropriated  funds.  The  resale 
stock  fund  and  operations  funds  are  included  in  the  Defense 
Business  Operating  Fund. 

DeCA  has  two  service  centers,  the  east  and  west  service  centers. 
The  commercial  accounts  branch  of  each  service  center  is 
responsible  for  processing  the  vendor  invoices  for  payment 
authorization.  The  service  centers  process  over  100,000  vendor 
invoices  each  month. 

Objectives 

The  overall  objective  was  to  determine  whether  financial 
statement  accounts  (such  as  inventory,  accounts  payable,  and  cost 
of  goods  sold)  affected  by  vendor  payments  and  managed  under 
DeCA's  Standard  Automated  Voucher  Examination  System  (SAVES) 
present  fairly  the  financial  position  for  the  accounts.  An 
additional  objective  was  to  determine  whether  DeCA  service 


centers  have  established  adequate  internal  controls  to  ensure 
compliance  with  laws  and  regulations  that  have  a  material  effect 
on  the  accounts  affected  by  vendor  payments. 

Scope 

We  reviewed  DeCA's  bill  paying  internal  control  policies  and 
procedures.  We  also  reviewed  payment  approval  vouchers, 
invoices,  receipt  information,  and  vendor  credit  memorandums.  We 
statistically  selected  for  audit  18  commissary  stores  and 
446  payment  authorization  transactions  for  CONUS  vendors  made 
during  the  period  October  1,  1991,  to  March  26,  1992.  The 
statistical  selection  plan  is  discussed  in  Appendix  A. 

This  financial  related  audit  was  made  from  October  1991  to 
September  1992  in  accordance  with  financial  auditing  standards 
issued  by  the  Comptroller  General  of  the  United  States  as 
implemented  by  the  Inspector  General,  DoD,  and  accordingly 
included  such  tests  of  internal  controls  as  were  considered 
necessary.  Organizations  visited  or  contacted  during  the  audit 
are  shown  in  Appendix  C. 

Internal  Controls 


The  audit  identified  material  internal  control  weaknesses  as 
defined  by  Public  Law  97-255,  Office  of  Management  and  Budget 
(0MB)  Circular  A-123,  and  DoD  Directive  5010.38.  Controls  were 
not  established  or  effective  to  ensure  that  payments  to  vendors 
were  accurate,  valid,  and  timely.  All  recommendations  in  this 
report,  if  implemented,  will  correct  the  weaknesses.  The 
monetary  benefits  that  can  be  realized  by  implementing  the 
recommendations  are  $208  million  (see  Appendix  B) .  A  copy  of  the 
final  report  will  be  provided  to  the  senior  official  responsible 
for  internal  controls  within  the  Office  of  the  Secretary  of 
Defense  (OSD)  and  DeCA. 

Prior  Audits  and  Other  Reviews 

The  Office  of  the  Inspector  General,  DoD  has  issued  the  following 
memorandums  and  reports  to  the  Director  DeCA: 

Inspector  General,  DoD,  "Management  Advisory  Memorandum 
Controls  Over  Vendor  Payments  and  Related  Transactions  for  the 
Defense  Commissary  Agency's  FY  1992  Resale  Stock  Fund  Financial 
Statements,"  March  17,  1992,  identified  the  results  of 

preliminary  review  of  internal  controls  over  vendor  payments.  We 
identified  conditions  that  affected  the  adequacy  of  internal 
controls  and  the  reliability  of  DeCA's  financial  data.  The 
memorandum  suggested  that  DeCA  document  and  enforce  its 
operational  policies  and  improve  compliance  with  the  Prompt 
Payment  Act.  In  response,  DeCA  stated  that  proper  procedures  and 
policies  had  already  been  implemented  but  additional  guidance 
would  be  prepared.  DeCA  also  stated  that  its  policy  is  to  pay 
only  proper  invoices  and  receipts  in  compliance  with  the  Prompt 
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Payment  Act.  Further,  DeCA  blamed  automated  data  processing 
complications  on  operating  software  problems,  data  storage,  and 
equipment . 

Inspector  General,  DoD,  ''Management  Advisory  Memorandum-Duplicate 
Vendor  Payments,  Audit  of  the  FY  1992  Resale  Stock  Fund  Financial 
Statements,"  May  4,  1992,  provided  audit  results  of  preliminary 
work  in  the  vendor  payment  area.  The  memorandum  concluded  that 
internal  controls  were  inadequate  to  ensure  that  authorized 
vendor  payments  did  not  result  in  duplicate  vendor  payments.  It 
suggested  that  DeCA  use  only  appropriately  trained  personnel  to 
enter  valid  invoice  data  that  show  invoice  numbers  compatible 
with  DeCA^'s  bill  paying  system.  The  memorandum  also  suggested 
that  receipt  information  be  entered  only  at  the  commissaries  and 
that  commissary  store  employees  delay  reentry  of  receipt 
information  until  signed  written  verification  of  a  proper 
reversal  can  be  obtained.  The  memorandum  further  suggested  that 
DeCA  develop  edit  checks  to  identify  possible  duplicate  payments 
and  establish  quality  control  programs  to  ensure  that  payments 
are  adequately  supported.  DeCA  concurred  with  the  suggested 
actions^  in  the  memorandum  and  took  steps  to  correct  the 
identified  conditions,  except  the  delayed  reentry  of  data  until 
verification  of  the  Service  Center's  reversal  of  the  previous 
receipt.  DeCA  stated  that  commissary  personnel  should  not 
reenter  any  receipt  data  that  was  initially  input  incorrectly, 
but  that  all  corrections  be  made  at  the  service  centers.  We  did 
not  take  exception  to  the  alternative  action  proposed  by  DeCA. 

Inspector  General,  DoD,  "Management  Advisory  Memorandum  -  Control 
Environment,  Audit  of  the  FY  1992  Resale  Stock  Fund  Financial 
Statements,"  September  29,  1992,  discussed  the  usage  of  the 
internal  review  and  IG  staffs  of  DeCA.  The  memorandum  suggested 
that  all  DeCA  IG  personnel  work  on  appropriate  oversight  projects 
and  not  operational  projects.  It  also  suggested  that  DeCA 
instruct  regional  auditors  to  report  to  the  Chief  of  the  Internal 
Review  Office  (IRO)  and  the  Chief  of  IRO  report  to  the  Deputy 
Director  or  Director.  Further,  the  memorandum  suggested  that 
DeCA  conduct  an  evaluation  of  staffing  resources  needed  to 
operate  an  effective  internal  oversight  mission.  DeCA  concurred 
with  all  the  suggested  actions  in  the  memorandum  and  is  taking 
action  to  correct  the  identified  conditions. 

Inspector  General,  DoD,  Audit  Report  No.  93-028,  "Quick-Reaction 
Report  on  Physical  and  System  Security  at  the  East  Service  Center 
of  the  Defense  Commissary  Agency,"  November  30,  1992,  reported 
that  DeCA's  East  Service  Center  had  not  developed  any  written 
policies  and  procedures  on  security  and  had  not  established  a 
formal  security  program.  The  report  stated  that  minimum  security 
requirements  included  provisions  for  the  accountability  of  user 
password  protection;  security  training  and  awareness;  and 
physical  control  of  hardware,  software,  and  data.  The  report 
recommended  that  DeCA  limit  the  system  administrator's  access  to 
databases;  develop  password  generation  procedures;  start 
conducting  security  entrance  and  exit  briefings  and  a  training 
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program;  establish  criteria  to  determine  who  is  allowed  access  to 
the  computer  room;  and  establish  a  contingency  plan  for  alternate 
site  processing.  DeCA  management  concurred  with  four  of  the 
five  report  recommendations.  DeCA  nonconcurred  with  limiting 
system  administrator  access,  but  proposed  an  acceptable 
alternative  action. 

Inspector  General,  DoD,  Audit  Report  No.  93-096,  "The  System  Used 
by  the  Defense  Commissary  Agency  to  Pay  Vendors'  Invoices," 
May  14,  1993,  concluded  that  DeCA's  system  for  paying  vendors' 
invoices  was  not  timely.  As  a  result  DeCA  missed  savings 
available  through  vendor  discounts  and  incurred  interest  expense. 
DeCA  had  also  not  reassessed  its  existing  staffing  levels  to 
redetermine  the  number  of  automated  data  processing  (ADP) 
personnel  needed  to  support  current  or  future  information 
systems.  We  recommended  that  the  Director,  DeCA,  revise  DeCA 
Directive  70-10  to  require  service  centers  and  its  commissaries 
to  improve  the  bill  paying  process,  taking  maximum  advantage  of 
discounts  for  prompt  payments  and  minimizing  interest  cost.  We 
also  recommeded  that  the  Assistant  Secretary  of  Defense 
(Production  and  Logistics)  request  an  independent  study  to 
determine  the  proper  staffing  levels  for  DeCA's  ADP  operations. 
Management  comments  to  our  recommendations  were  responsive  and 
management  is  acting  on  all  recommendations. 

Inspector  General,  DoD,  Audit  Report  No.  93-124,  "Report  on  the 
Controls  Over  Vendor  Payments ,  Returned  Checks ,  and  Rebates , " 
June  24,  1993,  reported  that  during  the  first  half  of  FY  1992, 
DeCA  did  not  adequately  control  financial  transactions  related  to 
vendor  payments,  returned  checks,  and  rebates.  As  a  result,  DeCA 
could  not  be  assured  that  the  financial  accounts  related  to 
vendor  payments  represent  appropriately  authorized  transactions. 
We  recommended  that  DeCA  issue  or  modify  procedures  to  ensure 
that  the  receipt  of  vendors'  merchandise  is  verified  and  that 
prompt  feedback  on  any  deficiencies  of  fast  payment  vendors  is 
provided  to  the  contracting  officers  and  require  that  vendor 
checks  be  endorsed  and  deposited  promptly.  We  also  recommended 
that  DeCA  record  the  estimated  rebates  due  from  cigarette  vendors 
as  an  account  receivable  on  the  financial  records,  periodically 
reconcile  the  actual  vendor  rebates  received  with  the  recorded 
accounts  receivable  amount,  and  separate  the  duties  of  personnel 
responsible  for  contracting  for  cigarette  rebates  from  personnel 
receiving  rebate  checks.  The  Director  concurred  or  partially 
concurred  with  our  recommended  actions.  The  Director  did  not 
agree  that  expired  contracts  must  be  removed  from  SAVES  in  order 
to  prevent  improper  vendor  payments  but  he  proposed  acceptable 
alternative  procedures. 

Other  Matters  of  Interest 


DeCA  has  taken  actions  to  improve  the  vendor  payment  process.  It 
has  established  written  policies  and  procedures  (DeCA 
Directives  70-10,  July  1,  1992,  and  70-16,  July  10,  1992)  at  the 
service  center  level  on  processing  bills,  contracting,  and 
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implementing  quality  assurance  reviews  to  support  payments  to 
vendors.  DeCA  has  also  installed  an  electronic  recognition 
system  that  notifies  the  system  of  transmittals  from  the 
commissaries,  and  an  edit  function  that  requires  a  completed 
invoice  number  field.  Additionally,  DeCA  has  implemented 

instructions  prohibiting  computer  access  password  sharing  and 
requiring  personnel  to  clear  screens  before  leaving  a  work 
station.  DeCA's  response  to  a  draft  of  this  report  included 
additional  steps  DeCA  has  taken  to  improve  bill  paying.  The 
steps  include  establishing  a  plan  to  help  small  businesses, 
retraining  bill  paying  personnel,  developing  contract  matrixes 
for  each  vendor,  and  preparing  a  bill  paying  guide  for  vendors. 

During  our  audit,  we  determined  that  DeCA  was  paying  vendors  more 
than  once  for  a  delivery.  The  extra  payments  occurred  because 
the  SAVES  lacked  rudimentary  edit  checks  that  would  detect 
duplicate  receipts  or  invoices.  In  February  1992,  we  informed 
DeCA,  and  DeCA  took  prompt  action  to  research  the  bill  paying 
system  for  duplicate  invoices.  As  a  result,  DeCA  deleted 
$191  million  in  duplicate  invoices  from  the  bill  paying  system. 
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PART  II  -  FINDINGS  AND  RECOMMENDATIONS 


A.  VENDOR  PAYMENT  PROCESSING  CONTROLS 


DeCA's  vendor  payment  process  did  not  provide  adequate  controls 
to  ensure  that,  during  the  first  half  of  FY  1992,  all  payment 
authorizations  for  vendor  invoices  were  authorized,  valid,  and 
accurate.  The  problem  occurred  because  DeCA  did  not  require 
adherence  to  existing  internal  control  procedures  and  directed 
employees  to  circumvent  control  practices.  Additionally,  DeCA 
did  not  test  and  adopt  an  adequate  vendor  payment  system  to 
include  written  procedures;  system  documentation,  adequate 
processing  controls,  such  as  ADP  edit  checks;  and  provide 
adequate  personnel  staffing,  training,  performance  standards,  and 
segregation  of  duties.  Further,  DeCA  did  not  adequately 
communicate  contract  numbers  to  vendors  and  ensure  that  there  was 
an  adequate  quality  assurance  program.  As  a  result,  DeCA's 
vendor  payment  records  and  financial  accounts  may  be  materially 
misstated.  Additionally,  during  the  first  half  of  FY  1992  DeCA 
authorized  payment  of  $404  million  for  payments  that  did  not  meet 
the  requirements  for  valid  payments,  as  established  by  the  DoD 
Accounting  Manual;  paid  $11  million  in  duplicate  payments;  and 
entered  another  $191  million  in  duplicate  invoices  into  the  bill 
paying  system.  For  FY  1992,  we  identified  potential  duplicate 
payments  of  up  to  a  total  of  $17  million. 

DISCUSSION  OF  DETAILS 


Background 

The  General  Accounting  Office  (GAO)  "Standards  For  Internal 
Controls  In  The  Federal  Government,"  1983,  and  the  DoD  Accounting 
Manual  (DoD  Manual  7220. 9-M),  February  1988,  state  that  adequate 
internal  controls  are  essential  for  accurate  and  reliable 
accounting  information  and  the  safeguarding  of  assets.  The 
documents  emphasize  that  management  has  the  responsibility  for 
establishing  and  maintaining  an  appropriate  internal  control 
structure.  During  a  1-year  transition  period,  prior  to 
October  1,  1991,  DeCA  planned  for  its  bill  paying  process  by 
selecting  a  modified  version  of  the  Army's  SAVES  as  its  bill 
paying  system. 

The  DoD  Accounting  Manual  requires  that  vendor  payments  be 
supported  by  a  proper  invoice,  evidence  of  delivery,  and  a  valid 
contract.  It  also  requires  that  the  invoice  amount  and  receipt 
amount  match  or  be  reconciled  if  the  amounts  differ  by  more  than 
an  established  dollar  threshold.  If  the  reconciliation  shows 
that  the  invoice  is  improper  (such  as  incorrect  description, 
price,  or  quantity)  the  vendor  is  to  be  notified. 


7 


DeCA  uses  SAVES  to  meet  the  requirements  of  the  DoD  Accounting 
Manual.  SAVES  depends  on  a  variety  of  inputs,  such  as 
contracting  and  pricing  information,  data  entry  of  vendor 
invoices  at  DeCA  bill  paying  service  centers,  and  entry  of 
receipt  information  from  the  commissary  stores.  SAVES  matches 
invoice  and  receipt  data  for  authorized  contracts  by  comparing 
the  contract  number,  call  (delivery)  number,  and  Department  of 
Defense  Activity  Address  Code  (store  identifier) . 

Invoices  matched  with  receipts,  within  a  $200  threshold,  appear 
on  a  precertification  listing  for  review  by  voucher  examiners 
1  business  day  before  being  listed  on  a  payment  approval  voucher 
and  paid  by  the  Defense  Finance  and  Accounting  Service  Center  - 
Columbus.  Voucher  examiners  are  required  to  reconcile 
differences  between  vendor  invoices  and  store  receipt  dollar 
amounts  that  are  in  excess  of  $200.  If  a  voucher  examiner  cannot 
locate  the  appropriate  invoice  to  support  the  payment,  the 
examiner  is  to  verbally  inform  a  team  leader.  The  team  leader 
decides  to  delete  or  retain  the  invoice  on  the  precertification 
listing.  If  no  action  is  taken  the  invoice  will  be  automatically 
authorized  for  payment  and  the  vendor  paid. 

invalid  and  Duplicate  Payments 

DeCA's  vendor  payment  process  did  not  ensure  that  all  payments 
made  to  vendors  were  authorized  and  valid  and  not  duplicates.  We 
categorized  payments  as  unauthorized  and  invalid  if  they  did  not 
meet  the  support  requirements  established  in  the  DoD  Accounting 
Manual;  that  is,  payments  certified  by  an  authorized  official  and 
supported  by  invoices,  evidence  of  delivery,  and  matching  invoice 
and  receipt  information. 

We  estimated  that  $404  million  (25  percent)  of  the  $1,625  billion 
in  vendor  payment  authorizations  from  October  1,  1991,  through 
March  26,  1992,  were  invalid.  Based  on  a  sample  of 
446  transactions,  there  were  171  invalid  payments,  as  follows: 
65  payments  were  not  supported  by  an  invoice;  60  did  not  have  a 
valid  matching  receipt;  35  were  not  supported  by  a  signed  payment 
authorization  voucher;  10  were  mismatched  invoices  and  receipts; 
and  1  payment  was  based  on  an  illegible  facsimile.  A  majority  of 
the  invalid  payments  included  two  or  more  of  the  invalid 
attributes. 

Based  on  our  review  of  446  transactions,  we  also  concluded  that 
DeCA's  controls  did  not  ensure  that  payment  authorizations  were 
not  duplicated.  Vendors  were  paid  more  than  once  on  a  submitted 
•'original”  invoice.  We  identified  26  occurrences  of  duplicate 
payments  totaling  $188,933,  which  were  used  to  statistically 
project  $11  million  in  duplicate  payments.  We  also  identified 
31  occurrences  totaling  $236,158,  where  DeCA  authorized  payment 
on  a  "nonoriginal”  invoice  from  a  vendor.  For  instance,  if  a 
vendor  was  not  paid  promptly  the  vendor  assumed  that  the  original 
invoice  was  lost  and  submitted  another  invoice  for  payment.  The 
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vendor  was  paid  for  both  invoices.  We  did  not  project  the 
duplicate  payments  on  a  nonoriginal  invoice;  however,  we  did 
project  duplicate  payments  made  on  the  same  original  invoice. 

Adherence  to  Existing  Internal  Controls 

DeCA  directed  personnel  to  weaken  existing  controls  to  expedite 
payments.  DeCA  managers,  in  the  absence  of  clearly  documented 
procedures,  authorized  personnel  to  deviate  from  sound  business 
practices.  The  practices  included  researching  differences 
between  receipts  and  invoices  before  reversals  or  changes  to 
receipt  data.  The  matching  of  receipt  and  invoice  data  and 
researching  differences  are  important  internal  controls. 

When  an  invoice  could  not  be  readily  matched  with  a  receipt,  DeCA 
voucher  examiners,  with  the  knowledge  of  DeCA  management, 
directed  personnel  at  commissary  stores  to  reenter  receipt 
information  under  a  second  contract  number  or  change  the  delivery 
number  to  expedite  payment.  Before  authorizing  payment,  the 
voucher  examiners  should  have  ensured  that  the  original  entries 
were  reversed  (deleted  from  data  base)  and  not  paid.  Although 
the  original  entry  was  supposed  to  be  reversed  to  prevent 
duplicate  payments,  the  service  centers  authorized  payments  for 
both  entries.  The  reversal  of  the  original  receipt  data  did  not 
occur  before  the  payments  were  verified  and  authorized; 
therefore,  the  double  payments. 

DeCA  management  weakened  controls  over  matching  invoice  and 
receipt  data  by  directing  personnel  to  not  reconcile  variances 
between  invoices  and  receipts  when  the  differences  exceeded  the 
specified  thresholds.  Variances  over  $200  required  a  line  by 
line  reconciliation  to  ensure  a  proper  matching  of  invoices  and 
receipts.  Instead,  the  voucher  examiners  paid  the  lesser  of  the 
invoice  or  receipt  amount.  As  previously  reported,  DeCA 
management  also  weakened  controls  by  directing  employees  to  make 
pen  and  ink  changes  to  invoices.  Employees  were  instructed  to 
change  information,  usually  the  contract  number  or  call  number, 
in  order  to  process  an  invoice.  Good  internal  control  requires 
returning  incorrect  invoices  to  vendors  for  correction. 

Testing  and  Adoption  of  a  Bill  Paving  system 

During  the  1-year  transition  phase  from  the  establishment  of  DeCA 
to  the  transfer  of  the  service  commissary  stores  to  DeCA,  DeCA 
did  not  test  and  adopt  a  bill  paying  system  that  included  written 
procedures  and  ADP  controls  such  as  edit  checks. 

Written  procedures  for  processing  vendor  payments.  DeCA  did 
not  establish  and  distribute  written  procedures  for  processing 
vendor  payments.  Policies  and  procedures  for  most  aspects  of  its 
operations,  including  procedures  for  processing  and  entering 
vendor  invoice  data  and  receipt  data  into  the  SAVES,  were  not 
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established  and  implemented.  Draft  procedures  for  processing 
vendors'  invoices  were  prepared;  however,  the  procedures  were  not 
distributed  to  the  personnel  performing  those  tasks. 

Because  the  draft  procedures  were  not  distributed,  the  east  and 
west  service  centers  were  using  different  invoice  processing 
procedures,  neither  of  which  included  adequate  internal  controls. 
DeCA  management  issued  bill  paying  guidance  to  the  service 
centers  in  July  1992,  10  months  after  DeCA  was  formed.  As 
previously  reported,  the  lack  of  documented  procedures 
contributed  to  the  incorrect  entry  of  invoice  and  receipt  data, 
and  subsequent  invalid  and  duplicate  payments. 

Invoice  data  entry.  DeCA  did  not  establish  adequate 
control  procedures  to  be  followed  by  data  entry  personnel  to 
ensure  that  invoice  numbers,  amounts,  and  other  data  were  entered 
accurately  and  consistently  in  the  automated  bill  paying  system. 
For  example,  the  same  invoice  number  was  entered  into  the  system 
two  different  ways;  and  several  vendor  invoice  amounts  were 
totaled  and  entered  into  the  automated  bill  paying  system  as  one 
invoice  amount,  with  only  one  of  the  several  invoice  numbers 
entered.  Additionally,  "net"  invoice  amounts  instead  of  "gross" 
invoice  amounts  were  entered  into  the  bill  paying  system. 

The  sampled  payment  transactions  showed  that  duplicate  payments 
can  be  very  difficult  to  detect  because  of  the  inaccurate  and 
inconsistent  data  entry  of  invoice  numbers.  For  example,  some  of 
DeCA's  data  entry  personnel  entered  slashes  and  dashes  from 
invoice  numbers,  others  did  not.  Invoice  number  704621060  was 
entered  as  704621060  and  70462-1060.  For  seven  duplicate 
payments,  valued  at  $67,703,  only  the  last  four  digits  of  the 
invoice  number  were  entered.  Adequate  internal  controls  would 
require  the  entry  of  complete  invoice  numbers. 

Receipt  data  entry.  DeCA  did  not  establish  adequate 
controls  over  receipt  data  entry.  Receipt  information  should  be 
entered  by  the  commissary  stores  based  on  signed  receiving 
reports.  We  could  not  obtain  signed  receiving  reports  for  60  of 
the  446  sampled  payment  transactions.  Service  center  personnel 
entered  receipt  data  based  on  unsigned  facsimile  transmittal 
documents  without  supporting  proof  of  delivery  from  the 
commissary  stores.  Commissary  stores  totaled  and  entered  several 
receipt  amounts  as  one  transaction,  without  evidence  that  all  the 
merchandise  was  actually  delivered.  Frequent  delivery  system  and 
direct  store  delivery  receipts  were  not  supported  by  detailed 
receiving  reports.  Delivery  documents  for  frequent  and  direct 
store  deliveries  were  not  retained  by  all  commissaries  for 
6  years  and  3  months,  as  required  by  DeCA  Directive  70-6. 

Automated  data  processing  controls.  DeCA  did  not  have 
adequate  ADP  system  controls.  Adequate  ADP  controls  include 
adequate  testing  during  systems  development;  proper  systems 
documentation;  built-in  systems  control  features,  such  as  edit 
checks  designed  to  prevent  the  reentry  of  the  same  data;  and 
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physical  and  procedural  safeguards  to  prevent  unauthorized  access 
and  usage  of  the  system.  The  ADP  controls  that  DeCA  established 
did  not  meet  system  requirements  and  did  not  ensure  that  payment 
data  were  input  accurately  and  consistently. 

ADP  systems  testing.  DeCA  did  not  adequately  test  its 
computer  system  and  the  computer  interfaces  with  the  computer 
systems  of  the  Military  Departments.  A  cause  of  DeCA's  bill 
paying  problems  was  the  inability  to  receive  and  process  receipt 
data.  Interfaces  with  other  computer  systems  must  be  thoroughly 
tested  before  a  new  or  modified  computer  system  is  implemented. 
Controls  should  be  tested  to  ensure  that  data  received  is 
accepted,  posted,  and  maintained  in  the  appropriate  accounting 
records . 

DeCA  adopted  a  modified  version  of  the  Army's _  SAVES;  but  it  did 
not  adequately  test  the  computer  system's  ability  to  interface 
with  other  computer  systems  in  the  Military  Departments  and 
support  about  250  commissary  stores  in  the  continental  United 
States.  The  SAVES  was  used  by  the  Army  Troop  Support  Agency  to 
process  vendor  payments  for  less  than  100  stores.  As  previously 
reported,  because  DeCA  did  not  adequately  test  the  modified 
version  of  SAVES,  the  system  was  not  always  available  due  to 
outages  and  long  overnight  processing  times,  had  slow  response 
times,  and  lost  data.  Loss  of  receipt  data  in  the  bill  paying 
system  understated  DeCA's  liability  to  vendors  and  understated 
DeCA  inventory  accounts. 

System  documentation.  The  bill  paying  computer  system 
was  not  adequately  documented.  Complete  and  adequate  system 
documentation  includes  the  documents  and  records  that  describe 
computer  processing  activities,  such  as  descriptions  and 
flowcharts  of  the  system  and  programs,  operating  instructions  for 
computer  operators;  control  procedures  to  be  followed  by 
operators  and  users;  and  descriptions  and  samples  of  required 
inputs  and  outputs.  The  documentation  provides  a  basis  for 
reviewing  the  system,  training  new  personnel,  and  maintaining  and 
revising  existing  systems  and  programs.  DeCA  was  unable  to 
provide  the  ADP  system  documentation  to  us. 

Edit  checks.  As  previously  reported,  DeCA  did  not 
implement  adequate  edit  checks  in  the  automated  bill  paying 
system  to  prevent  invalid  and  duplicate  payments  to  vendors.  The 
primary  edit  check  in  SAVES  matched  the  contract  number,  delivery 
number,  and  DoD  activity  code  with  receipt  data.  If  the  data 
were  not  duplicated  in  SAVES  and  the  receipt  amount  matched 
within  established  dollar  limits,  the  transaction  was  processed. 
DeCA  personnel  repeatedly  circumvented  the  edit  checks  in  place 
by  making  pen  and  ink  changes  to  original  vendor  invoices  and 
entering  the  revised  data  into  SAVES. 

Our  sample  disclosed  pairs  of  duplicate  payment  transactions  with 
the  same  invoice  number  and  vendor  and  often  exactly  the  same 
dollar  amount.  Most  of  the  duplicate  payment  transactions  in  our 
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sample  had  a  changed  contract  or  delivery  number.  DeCA  was 
unable  to  provide  us  documentation  showing  that  additional  edit 
checks  existed  within  the  automated  bill  paying  system  to  prevent 
duplicate  or  invalid  payments.  DeCA  personnel  stated  that  the 
SAVES  would  accept  the  entry  of  data  from  the  same  invoice  for 
the  same  delivery  if  either  the  contract  number  or  the  call 
number  was  changed. 

Although  DeCA  has  been  working  actively  to  purge  the  known 
duplicate  invoices  from  the  system,  the  bill  paying  system  must 
be  corrected  so  that  it  does  not  allow  duplicate  invoices  to  be 
entered.  An  additional  edit  check  on  the  vendor  and  invoice 
number  would  greatly  reduce  the  number  of  duplicate  invoices  in 
the  system.  Parameter  checks  and  edits  based  on  dates  could 
reduce  the  number  of  invalid  and  duplicate  payments.  For 
example,  an  edit  check  could  compare  the  date  merchandise  was 
delivered  to  a  commissary  store  with  the  date  of  an  invoice.  If 
the  merchandise  was  delivered  after  the  date  of  the  invoice,  the 
invoice  would  not  be  processed  until  additional  research  was 
done. 


Access  controls.  As  previously  reported,  managers  and 
other  personnel  at  a  bill  paying  service  center  informed  us  that 
log-on  codes,  passwords,  and  clerk  ID's  were  shared.  Personnel 
responsible  for  entering  data  into  the  automated  bill  paying 
system  were  sharing  passwords.  A  "master"  password  was  being 
used  by  three  individuals  to  enter  receipt  information  into  the 
system.  One  of  the  three  employees  worked  in  the  computer  room 
where  merchandise  prices  are  changed.  Passwords  should  be  unique 
and  identify  the  holder  as  an  authorized  user.  The  use  of  unique 
passwords  provides  access  control  and  management  with  a  way  to 
monitor  computer  utilization.  DeCA  management  informed  us  that 
the  practice  of  password  sharing  has  been  eliminated. 

Personnel.  DeCA  did  not  hire  enough  personnel  to  handle  bill 
paying,  adequately  train  bill  paying  personnel,  establish 
adequate  performance  standards  for  voucher  examiners,  and 
segregate  duties  of  personnel.  DeCA  had  to  hire  temporary 
personnel  to  help  reduce  the  backlog  of  data  entry  and  vendor 
payments.  Neither  the  temporary  nor  the  permanent  staff  were 
trained  to  process  payment  approval  vouchers  and  supporting 
invoices  in  a  controlled  manner.  The  supervisory  span  of  control 
for  the  voucher  examiner  employees  was  excessive,  an  average  of 
15  employees,  more  employees  than  could  be  adequately  trained  and 
supervised.  Additionally,  the  performance  standards  for  voucher 
examiners  did  not  include  as  a  performance  element,  the  prompt 
processing  of  vendor  payments. 

During  our  audit,  DeCA  decided  that  more  personnel  were  required 
and  initiated  action  to  hire  and  train  additional  full-time  bill 
paying  personnel.  New  employee  training  was  to  include  fraud 
awareness  briefings.  Further,  performance  standards  were  being 
revised  for  voucher  examiners'  processing  of  vendor  payments  in 
accordance  with  the  Prompt  Payment  Act. 
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Segregation  of  duties.  In  addition  to  the  quantity  and 
training  of  personnel,  the  organizational  placement  of  personnel 
can  adversely  affect  internal  controls.  A  common  control 
technique  requires  the  segregation  of  duties,  that  is,  a 
financial  manager  should  not  be  responsible  for  accounting 
related  duties.  Under  DeCA's  structure  a  service  center  director 
was  responsible  for  accounting  functions,  such  as  bill  paying  and 
account  reconciliation,  as  well  as  operational  functions,  such  as 
inventory  management.  Operationally  oriented  managers  emphasized 
the  volume  of  payments  without  regard  to  the  need  for  proper 
internal  controls.  DeCA's  failure  to  segregate  duties 
contributed  to  the  lack  of  adequate  controls  over  vendor 
payments.  Operational  control  of  vendor  payments  should  have 
been  placed  under  the  Director,  Resource  Management. 

Communication  with  Vendors .  DeCA  did  not  adequately 
communicate  newly  established  contract  numbers  to  vendors  and 
commissary  stores.  As  a  result,  deliveries  were  reported  by  the 
commissaries  under  one  contract  number  and  invoiced  by  the  vendor 
under  another  contract  number.  For  payment  to  occur  under  DeCA's 
bill  paying  system,  invoices  and  deliveries  must  be  recorded 
separately,  but  under  the  same  contract  number.  Nonmatched 
invoice  and  receipt  data  increased  the  backlog  of  unpaid 
invoices.  To  reduce  the  contract  number  confusion,  DeCA  used 
numerous  means  to  inform  the  vendors  of  the  correct  contract 
numbers  and  directed  regional  headquarters  to  develop  matrices  of 
contract  numbers  according  to  DoD  activity  and  vendor. 

Quality  Assurance  Program 

DeCA  did  not  have  a  written  quality  control  plan  to  review  vendor 
payments  for  adequate  support  and  appropriate  authorizations  and 
to  review  the  vendor  payment  process.  A  review  of  payments  after 
the  fact  is  an  important  procedure  to  ensure  that  operating 
personnel  are  following  the  approved  policies  and  procedures  and 
payments  are  appropriate  and  correct.  Operating  personnel  were 
not  following  approved  policies  and  procedures  and  payments  made 
were  not  appropriate  and  correct  because  DeCA  did  not  establish  a 
written  plan  for  evaluating,  testing,  and  monitoring  the  bill 
paying  process.  The  internal  control  weaknesses  that  we  noted 
for  duplicate  and  invalid  payments  would  have  been  readily 
detected  during  quality  control  reviews  using  an  adequate  quality 
control  plan. 

Subsequent  Actions 

As  discussed  in  Part  I,  Other  Matters  of  Interest,  DeCA  deleted 
$191  million  in  duplicate  receipts  or  invoices  awaiting  payment 
from  SAVES.  The  items  were  deleted  after  we  advised  DeCA  in 
February  1992  of  the  need  for  rudimentary  edit  checks  to  detect 
duplicate  receipts  or  invoices. 
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After  the  completion  of  our  fieldwork,  we  obtained  computer  tapes 
from  DeCA  containing  all  payment  authorizations  processed  in 
SAVES  for  FY  1992.  We  analyzed  the  data  to  determine  the  total 
potential  duplicate  payments  processed  during  FY  1992.  We 
designed  edits  based  on  the  results  of  our  analysis  of  the 
statistical  sample  for  this  report.  The  edits  were  based  on 
duplicate  or  similar  invoice  numbers,  invoice  amounts,  and  dates. 
We  found  approximately  $17  million  of  potential  duplicate 
payments  for  FY  1992.  We  have  provided  a  listing  of  the 
transactions  to  DeCA  management  for  further  analysis. 


RECOMMENDATIONS.  MANAGEMENT  COMMENTS.  AND  AUDIT  RESPONSE 

We  recommend  that  the  Director,  Defense  Commissary  Agency  (DeCA) : 

1.  Obtain  Standard  Automated  Voucher  Examination  System 
documentation  and  upgrade  automatic  data  processing  capabilities, 
by  increasing  computer  edit  checks,  and  documenting  the  internal 
controls  for  the  bill  paying  computer  system. 

Management  comments .  The  Director,  DeCA,  concurred  with 
Recommendation  1.,  stating  that  about  85  percent  of  the  ADP 
documentation  has  been  developed  and  the  additional  15  percent  is 
being  developed.  The  target  date  for  completion  of  ADP  docu¬ 
mentation  is  July  31,  1993.  Additionally,  the  Director  stated 

that  edit  checks  of  the  invoice  number  were  stopped  by  DeCA  after 
initial  implementation.  The  Director  also  stated  that  the  full 
implementation  of  the  DeCA  Interim  Business  System  will  further 
ensure  there  is  no  recurrence  of  the  contract  and  order  number 
problems  experienced  by  DeCA.  The  complete  text  of  management 
comments  is  provided  in  Part  IV. 

Audit  response.  The  Director  was  partially  responsive  to 
the  audit  recommendation.  Appropriate  actions  are  being  taken 
regarding  SAVES  documentation.  However,  no  mention  was  made  of 
the  need  for  additional  edit  checks  within  SAVES  to  ensure  that 
duplicate  payment  of  invoices  does  not  occur.  Therefore,  we 
request  additional  comments  in  response  to  the  final  report. 

2.  Place  all  financial  functions  under  the  operational 
control  of  the  Director,  Resource  Management. 

Management  comments .  The  Director,  DeCA,  concurred  with 
Recommendation  2.,  stating  that  all  finance  functions  have  been 
placed  under  the  operational  control  of  the  Director,  Resource 
Management . 

Audit  response.  The  Director  was  responsive  to  the  audit 
recommendation . 

3.  Establish  a  written  plan  for  evaluating,  testing,  and 
monitoring  the  bill  paying  system. 
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Management  conuaents .  The  Director,  DeCA,  concurred  with 
Recommendation  3 . ,  stating  that  several  directives  have  been 
issued  and  implemented  which  have  significantly  improved  DeCA's 
system  testing  and  other  ADP  functions. 

Audit  response .  The  Director  was  responsive  to  the  audit 
recommendation;  however,  the  intent  of  the  recommendation  was  the 
establishment  of  a  written  quality  assurance  plan  for  testing  the 
implementation  of  the  bill  paying  process  by  internal  review  or 
other  quality  control  personnel.  We  request  that  the  Director 
provide  additional  comments  to  the  recommendation  in  his  response 
to  the  final  report. 

4.  Research  the  listing  of  FY  1992  potential  duplicate 
payments  provided  to  DeCA  and  take  action  to  recoup  duplicate 
payments . 

Management  comments .  The  Director,  DeCA,  concurred  with 
Recommendation  4 . ,  stating  that  a  dedicated  team  at  each  service 
center  is  reviewing  invoices  for  duplication,  and  that  action  is 
being  taken  to  collect  duplicate  payments. 

Audit  response .  The  Director  was  responsive  to  the  audit 
recommendation . 

Potential  Monetary  Benefits.  The  Director,  DeCA  did  not 
concur  with  the  amount  of  the  projected  monetary  benefit  of 
$17  million.  Based  on  research  of  potential  duplicate  payments 
the  service  centers  project  about  $8.6  million  in  actual 
recovered  duplicate  payments.  Further,  the  Director  did  not 
concur  with  the  $191  million  in  benefits  claiming  that  the 
invalid  invoices  were  removed  from  the  bill  paying  system  by 
service  center  personnel  as  erroneous  invoices.  DeCA  was  aware 
of  the  invalid  invoice  records  and  would  not  have  permitted  them 
to  be  paid  in  error. 

Audit  response.  The  DeCA  estimate  of  about  $8.6  million  is 
based  on  a  listing  we  provided  to  DeCA  containing  about 
$11  million  in  duplicate  payments.  We  used  the  list  in  our 
statistical  sample,  covering  the  period  from  October  1,  1991, 
through  March  26,  1992.  The  monetary  benefits  we  claimed  were 
based  on  a  second  tape  provided  to  DeCA.  The  tape  was  an  updated 
analysis  of  duplicate  payments  generated  by  the  audit  staff  using 
payment  data  for  all  of  FY  1992,  October  1,  1991,  through 
September  30,  1992.  The  second  tape  used  the  same  criteria  for 
identifying  duplicate  payments  as  the  first  listing  provided  to 
DeCA . 


Other  Matters  of  Interest.  Regarding  the  $191  million  in 
invoices  removed  from  the  SAVES,  DeCA  was  not  aware  of  the 
duplicate  invoice  problem  until  we  briefed  the  Director,  DeCA,  in 
early  February  1992,  about  duplicate  payments  and  invoices  that 
we  had  discovered  in  January  1992.  In  a  May  4,  1992,  memorandum 
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the  previous  Director,  DeCA,  said  he  first  became  aware  of  the 
duplicate  payments  when  the  IG  audit  team  briefed  him  in  February 
1992.  The  conditions  at  DeCA,  as  stated  in  this  report,  were 
such  that  many  of  the  duplicate  invoices  would  have  been  paid. 
The  additional  emphasis  on  removing  duplicate  invoices  was  a 
direct  result  of  IG,  DoD,  communications  with  DeCA  and  the  record 
ought  to  reflect  that  fact.  We  request  management  comments  to 
the  final  report  regarding  the  monetary  benefits. 
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B.  ADHERENCE  TO  THE  PROMPT  PAYMENT  ACT 


DeCA  did  not  comply  with  all  the  requirements  of  the  Prompt 
Payment  Act  and  0MB  Circular  A-125  or  take  advantage  of  all 
vendor  discounts  offered.  The  noncompliance  occurred  because 
DeCA  did  not  require  development  of  a  reliable  system  of  internal 
controls  for  processing  invoices  for  payment,  as  discussed  in 
Finding  A.  Additionally,  processing  delays  and  DeCA's  failure  to 
issue  directives  implementing  0MB  Circular  A-125  contributed  to 
the  noncompliance.  As  a  result,  DeCA  paid  almost  $6  million  in 
interest  and  sustained  lost  discounts  of  about  $2.9  million 
during  FY  1992.  Additionally,  we  project  that  DeCA  underpaid 
about  $2.4  million  in  interest  to  vendors  during  the  first  half 
of  FY  1992. 


DISCUSSION  OF  DETAILS 


Background 

The  Prompt  Payment  Act  (Public  Law  97-177  [S.  1131]  May  21,  1982, 
and  Public  Law  100-496  [S.  328]  October  17,  1988)  requires  each 

Federal  agency  acquiring  property  or  services  from  a  vendor  to 
pay  interest  if  payment  is  not  made  by  the  required  payment  date. 
The  required  payment  date  is  the  later  of  either  the  date  on 
which  payment  is  due  under  the  terms  of  the  contract,  or  30  days 
after  receipt  of  a  proper  invoice.  In  the  case  of  meat  or  a  meat 
food  product,  the  Packers  and  Stockyards  Act  of  1921  (United 
States  Code,  title  7,  section  182  [3]),  specifies  the  payment 

date  as  7  days  after  the  date  of  delivery.  The  Prompt  Payment 
Act  requires  Federal  agencies  to  notify  the  vendor  promptly  of 
any  defect  or  impropriety  in  an  invoice  that  would  prevent 
payment  and  the  accruing  of  interest.  If  a  vendor  offers  a 
Federal  agency  a  discount  from  the  amount  due  in  exchange  for 
payment  within  a  specified  period,  the  Federal  agency  may  take 
the  discount  if  payment  is  made  within  the  specified  period. 

0MB  Circular  A-125,  "Prompt  Payment,"  implements  the  Prompt 
Payment  Act  and  requires  executive  departments  and  agencies  to 
make  payments  on  time,  to  pay  interest  penalties  when  payments 
are  late,  and  to  take  discounts  only  when  payments  are  made  on  or 
before  the  discount  date.  0MB  Circular  A-125  states,  "The  agency 
must  assure  that  effective  internal  control  systems  are 
established  and  maintained  as  required  by  0MB  Circular  A-123, 
"Internal  Control  Systems,"  to  provide  reasonable  assurance  that 
administrative  activities  required  under  0MB  Circular  A-125  are 
effectively  and  efficiently  carried  out." 

Processing  Delays 

Our  review  of  selected  sample  items,  during  the  first  half  of 
FY  1992,  from  the  paid  vouchers  located  at  DeCA's  east  and  west 
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service  centers  disclosed  that  144  of  304  sampled  items  were  paid 
late.  (For  our  analysis  of  prompt  payment,  we  assumed  that 
142  items  that  lacked  support  were  paid  correctly.  This  may 
understate  the  amount  of  unpaid  interest  to  vendors.)  DeCA's 
processing  of  vendors'  invoices  for  payment  was  delayed  by 
processing  weaknesses.  The  weaknesses  included  delays  in  mail 
room  openings,  date  annotation,  and  forwarding  mail  to  the 
voucher  examination  area.  Additionally,  data  entry  personnel  did 
not  promptly  enter  data  from  invoices  into  the  bill  paying 
system,  because  often  computer  system  problems  rendered  the  SAVES 
unavailable. 

DeCA  service  centers  had  unprocessed  new  and  old  invoices 
literally  pile  up  in  mail  buckets  and  filing  cabinets  and  on 
voucher  examiners'  desks.  DeCA  had  not  entered  into  SAVES  an 
estimated  78,000  invoices  at  the  time  of  our  audit  planning 
visits  in  December  1991  and  January  1992.  As  a  result  of 
processing  weaknesses  and  a  previously  discussed  shortage  in 
properly  assigned  and  trained  personnel,  DeCA  paid  $6  million  in 
interest  during  FY  1992.  Processing  delays  also  contributed  to 
DeCA  not  taking  $2.9  million  of  the  $11.7  million  in  vendor 
discounts  offered  to  it  during  FY  1992.  Additionally, 
noncompliance  with  0MB  Circular  A-125  resulted  in  a  projected 
underpayment  of  about  $2.4  million  in  interest  to  vendors  during 
the  first  half  of  FY  1992. 

Implementation  of  0MB  Circular  A-125 

DeCA  did  not  comply  with  0MB  Circular  A-125.  The  noncompliance 
occurred  because  DeCA  did  not  issue  implementing  regulations 
promptly  and  establish  the  necessary  internal  control  systems. 
Additionally,  DeCA  managers  directed  personnel  to  follow 
procedures  other  than  those  required  by  0MB  Circular  A-125. 

Determination  of  due  dates.  OMB  Circular  A-125  states  that 
for  the  purposes  of  determining  a  payment  due  date  and  the  date 
on  which  interest  will  begin  to  accrue,  an  invoice  shall  be 
deemed  to  be  received  on  the  date  a  proper  invoice  is  actually 
received  by  the  designated  billing  office.  The  agency  should 
annotate  the  invoice  with  the  date  of  receipt  at  the  time  of 
receipt.  DeCA  personnel  did  not  always  annotate  invoices 
received  with  the  date  of  receipt.  A  DeCA  manager  directed  that 
invoices  received  on  a  Saturday  be  annotated  on  a  Monday  with 
Monday's  date.  Annotating  a  later  receipt  date  delayed  the  start 
of  the  interest  payment  period  and  would  reduce  the  interest  paid 
on  late  payments. 

DeCA  personnel  also  did  not  enter  the  due  date  accurately  into 
the  bill  paying  system  for  interest  calculations  for  153  of 
304  items  in  our  sample.  DeCA  managers  directed  personnel  to  use 
a  date  later  than  the  annotated  date  of  invoice  receipt  as  the 
basis  for  calculating  the  due  date.  For  example,  if  DeCA 
personnel  made  pen  and  ink  changes  weeks  after  receiving  an 
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invoice,  DeCA  instructed  its  personnel  to  use  the  date  of  the 
changes  as  the  date  of  invoice  receipt  for  calculating  the  due 
date. 

Return  of  Improper  Invoices.  DeCA  personnel  did  not  promptly 
return  all  improper  invoices  to  vendors  for  correction.  An 
improper  invoice  is  one  lacking  information  required  to  make 
payment,  such  as  name  of  vendor;  contract  number;  description, 
price,  and  quantity  of  goods  delivered;  payment  terms;  and  where 
payment  is  to  be  sent.  0MB  Circular  A-125  states,  "...each 
invoice  will  be  reviewed  as  soon  as  practical  after  receipt  to 
determine  whether  the  invoice  is  a  proper  invoice;  any  invoice 
determined  not  to  be  a  proper  invoice  shall  be  returned  as  soon 
as  practicable.  Calculation  of  interest  penalties,  if  any,  will 
be  based  on  an  adjusted  due  date  reflecting  the  reduced  number  of 
days  allowable  for  payment." 

Rather  than  returning  improper  invoices ,  DeCA  directed  its 
personnel  to  retain  some  improper  invoices  for  correction. 
Because  invoices  were  not  returned  to  vendors  to  correct,  they 
did  not  receive  payments  promptly.  When  DeCA  calculated  the  due 
dates  for  invoices  it  did  not  increase  the  interest  payment 
period  for  the  days  it  held  the  improper  invoices  in  excess  of 
the  number  of  days  permitted  by  the  Prompt  Payment  Act. 

For  invoices  returned  to  vendors  for  correction,  DeCA  did  not 
maintain  adequate  records.  It  kept  summary  records  of  returned 
invoices  on  manual  logs,  but  did  not  record  the  specific  invoices 
returned.  Thus,  it  would  be  difficult  to  discern  whether  a 
received  invoice  was  an  original,  duplicate,  or  corrected 
invoice. 

DeCA  was  developing  a  separate  automated  data  base  for  recording 
invoices  returned  to  vendors  that  will  not  be  part  of  SAVES. 
Unlike  the  automated  bill  paying  system,  the  new  system  will 
identify  an  invoice  during  data  entry  as  an  original  or  a 
resubmission  of  a  corrected  invoice.  The  automated  tracking  of 
returned  invoices  should  be  part  of  SAVES  to  reduce  the  potential 
for  error.  At  the  time  of  this  report  DeCA  had  not  implemented 
the  new  system. 

Subsequent  Actions 

DeCA  has  taken  actions  to  comply  with  0MB  Circular  A-125.  DeCA 
established  written  policies  and  procedures  (DeCA  Direc¬ 
tives  70-10,  July  1,  1992  and  70-16,  July  10.  1992)  at  the 
service  center  level  on  processing  vendor  payments.  DeCA 
Directive  70-10  includes  guidance  on  calculating  interest  and 
incorporates  the  requirements  of  0MB  Circular  A-125.  Further, 
DeCA  was  also  revising  performance  standards  for  voucher 
examiners'  processing  of  vendor  payments  in  accordance  with  the 
Prompt  Payment  Act.  The  performance  standards  include  the 
requirement  for  prompt  return  of  incorrect  vendor  invoices. 
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RECOMMENDATIONS.  MANAGEMENT  COMMENTS.  AND  AUDIT  RESPONSE 


We  recommend  that  the  Director,  Defense  Commissary  Agency  (DeCA) : 

1.  Establish  controls  to  ensure  that  service  center 
personnel  meet  requirements  of  the  Prompt  Payment  Act. 

Management  comments .  The  Director,  DeCA,  concurred  with 

Recommendation  1.,  stating  that  DeCA  Directive  70-10  provides 
procedures  to  ensure  compliance  with  the  Prompt  Payment  Act. 
Service  center  personnel  were  trained  on  these  procedures  in 

May  1992,  Additionally,  a  special  headquarters  team  reviewed 

bill  paying  and  trained  personnel  from  September  1992  through 
March  1993. 

Audit  response.  The  Director's  indicated  actions  are 
responsive  to  the  audit  recommendation. 

2.  Maintain  automated  records  in  the  Standard  Automated 
Voucher  Examination  system  to  distinguish  between  original 
invoice  submissions  and  corrected  invoice  submissions. 
Additionally,  DeCA  should  develop  a  feature  to  record  and  track 
invoices  returned  to  vendors  and  resubmitted  for  payment. 

Management  comments .  The  Director,  DeCA,  concurred  with 

Recommendation  2.,  stating  that  DeCA  developed  and  provided  to 
the  service  centers  an  automated  off-line  method  of  tracking 
invalid  invoices  in  October  and  November  1992.  The  Director  also 
stated  that  DeCA  is  working  toward  incorporating  the  tracking  of 
returned  invoices  into  SAVES  and  expects  this  action  to  be 
completed  by  July  1994. 

Audit  response.  The  Director's  indicated  actions  are 
responsive  to  the  audit  recommendation. 
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APPENDIX  A.  STATISTICAL  Sl^PLING  PLAN  AND  RESULTS 


Sampling  Plan 

An  objective  of  this  audit  was  to  determine  the  effectiveness  of 
internal  controls  over  vendor  payments  at  DeCA.  In  support  of 
this  objective,  we  made  statistical  projections  based  on  complex 
sampling  designs  of  the  total  dollar  amounts  of  duplicate 
payments  and  of  invalid  payments  in  the  audit  universe.  We  also 
projected  statistically  the  net  amount  of  unpaid  interest  on 
untimely  vendor  payments  subject  to  the  Prompt  Payment  Act. 

The  audit  universe  consisted  of  all  vendor  payments  made  by  DeCA 
CONUS  installations  from  October  1,  1991  to  March  26,  1992.  DeCA 
CONUS  contained  250  installations  and  approximately 
$1,624.8  million  in  vendor  payments.  (An  installation  was 
defined  as  a  store  or  a  Central  Distribution  Center.)  Troop 
issue  payments  were  combined  with  those  of  the  store  at  the  same 
site.  The  SAVES  data  base  was  the  source  for  the  data. 

In  cases  where  multiple  vendor  payments  were  made  on  the  same 
invoice,  duplicate  payments  were  defined  as  the  chronologically 
second  and  subsequent  such  payments.  Invalid  vendor  payments 
were  defined  as  payments  made  without  proper  support  or  with 
incorrect  matching  of  invoice  and  receipt.  These  categories  are 
mutually  exclusive.  None  of  the  sampled  payments  that  were 
identified  as  duplicate  payments  were  counted  as  invalid 
payments.  It  is  possible,  however,  that  the  first  of  multiple 
payments  on  the  same  invoice  could  be  an  invalid  payment.  Unpaid 
interest  on  untimely  payments  was  defined  as  the  difference 
between  IG,  DoD  calculation  of  the  interest  due  and  the  interest 
reported  as  paid  in  the  SAVES  data  base.  Differences  of  less 
than  one  dollar  (five  cases)  were  treated  as  correct.  Two  cases 
of  interest  overpayment  were  included  so  the  statistical 
projection  is  of  net  interest  unpaid. 

We  employed  stratified  multi-stage  random  sampling  as  the 
sampling  design  for  this  audit.  We  grouped  installations  by 
geographic  location  and  total  payment  dollars.  We  divided  the 
installations  into  two  strata;  those  in  high  payment  dollar 
geographic  areas  and  those  in  low  dollar  amount  areas.  Within 
the  high  stratum,  we  selected  14  installations  using  probability 
proportional  to  size  (PPS)  sampling  with  replacement.  The 
measure  of  size  we  used  was  the  total  dollar  amounts  of  the 
payments  associated  with  the  installations.  Within  the  low 
stratum,  we  selected  six  installations  using  simple  random 
sampling  (SRS)  without  replacement.  We  separated  the  vendor 
payments  within  each  of  the  selected  installations  into  four 
strata;  probable  duplicate  payments  (A)  ,  possible  duplicate 
payments  (B) ,  payments  with  no  invoice  numbers  (C) ,  and  all  other 
payments  (D)  .  We  selected  payments  in  those  strata  within  each 
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APPENDIX  A.  STATISTICAL  SAMPLING  PLAN  AND  RESULTS  (cont'd) 


sampled  installation  using  PPS  sampling  with  replacement.  We 
sampled  3  unique  payments  from  each  A  stratum,  4  from  each 
B  stratum,  3  from  each  C  stratum,  and  13  from  each  D  stratum. 

Sampling  Results.  Statistical  projections  of  the  sample  data  are 
as  follows. 


95  Percent 

Confidence 

Intervals 

Lower 

Bound 

Point 

Estimate 

(Million) 

Upper 

Bound 

Duplicate  Payments 

$  3.9 

$  11.4 

$  18.8 

Invalid  Payments 

210.6 

403.5 

596.5 

Net  Unpaid  Interest 

1.2 

2.4 

3.5 

We  are  95  percent  confident  that  between  $3.9  million  and 
$18.8  million  in  duplicate  vendor  payments  were  made  by  DeCA  for 
CONUS  installations  from  October  1,  1991,  to  March  26,  1992.  The 
unbiased  point  estimate  of  $11.4  million  is  the  most  likely 
single  value  for  duplicate  payments  in  DeCA  CONUS. 

We  are  also  95  percent  certain  that  between  $210.6  million  and 
$596.5  million  of  the  vendor  payments  in  the  specified  population 
are  invalid.  The  most  likely  single  value  for  the  dollar  amount 
of  invalid  payments  in  the  population  is  $403.5  million. 

Also,  we  are  95  percent  confident  that  between  $1.2  million  and 
$3.5  million  in  net  interest  on  untimely  vendor  payments  was 
unpaid  by  DeCA  for  CONUS  installations  from  October  1,  1991,  to 
March  26,  1992.  The  unbiased  point  estimate,  $2.4  million,  is 
the  most  likely  single  value  for  net  unpaid  interest  in  this 
population. 
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APPENDIX  B.  SUMMARY  OF  POTENTIAL  BENEFITS  RESULTING  FROM  AUDIT 


Recommendation 

Reference 


A. 1. ,  A. 2 . , 
A . 3 . ,  and 

A. 4. 


B . 1 .  and  B . 2 . 


Other  Matters 
of  Interest 


Description  of  Benefits 

Economy  and  Efficiency 
and  Internal  Controls. 

A  properly  designed  vendor 
payment  system  will 
provide  a  more  effective 
system  and  reduce  invalid 
and  duplicate  payments. 

Compliance.  Follow 
procedures  for 
determining  due  dates 
and  interest  paid  in 
compliance  with  the 
Prompt  Payment  Act  and 
0MB  Circular  A-125. 


Amount  and/or 
Type  of  Benefit 

Funds  put  to 
better  use .  DeCA 
could  recoup  up  to 
$17  million  in 
duplicate  pay¬ 
ments  to  vendors. 


Undeterminable . 


Funds  put  to 
better  use. 

DeCA  avoided 
authorizing 
$191  million  in 
duplicate  pay¬ 
ments  after  being 
advised  of 
duplicate  invoices 
by  the  auditors. 


25 


This  page  was-  left  out  of  original  document 


APPENDIX  C.  ORGANIZATIONS  VISITED  OR  CONTACTED 


Office  of  the  Secretary  of  Defense 

Assistant  Secretary  of  Defense  (Production  and  Logistics) 

Defense  Agencies 

Defense  Commissary  Agency  Headquarters,  Fort  Lee,  Petersburg,  VA 
Defense  Commissary  Agency,  East  Service  Center,  Fort  Lee, 
Petersburg ,  VA 

Defense  Commissary  Agency,  West  Service  Center, 

Kelly  Air  Force  Base,  San  Antonio,  TX 
Alameda  Naval  Air  Station,  Commissary  Resale  Store,  Alameda,  CA 
Charles  Melvin  Price  Support  Center,  Commissary  Resale  Store, 
Granite  City,  IL 

Fort  Benjamin  Harrison,  Commissary  Resale  Store,  Indianapolis,  IN 
Fort  Carson,  Commissary  Resale  Store,  Colorado  Springs,  CO 
Fort  Huachuca,  Commissary  Resale  Store,  Sierra  Vista,  AZ 
Fort  Monroe,  Commissary  Resale  Store,  Hampton,  VA 
Fort  Ord,  Commissary  Resale  Store,  Monterey,  CA 

Holloman  Air  Force  Base,  Commissary  Resale  Store,  Alamogordo,  NM 
Jacksonville  Naval  Air  Station,  Commissary  Resale  Store, 
Jacksonville,  FL 

Kingsville  Naval  Air  Station,  Commissary  Resale  Store, 

Kingsville,  TX 

Langley  Air  Force  Base,  Commissary  Resale  Store,  Hampton,  VA 
March  Air  Force  Base,  Commissary  Resale  Store,  Riverside,  CA 
McChord  Air  Force  Base,  Commissary  Resale  Store,  Tacoma,  WA 
National  City  Central  Distribution  Center,  San  Diego,  CA 
Norton  Air  Force  Base,  Commissary  Resale  Store, 

San  Bernardino ,  CA 

Oceana  Commissary  Resale  Store,  Virginia  Beach,  VA 

Patrick  Air  Force  Base,  Commissary  Resale  Store,  Cocoa  Beach,  FL 

U.S.  Air  Force  Academy,  Commissary  Resale  Store, 

Colorado  Springs,  CO 

Wurtsmith  Air  Force  Base,  Commissary  Resale  Store,  Oscoda,  MI 
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APPENDIX  D.  REPORT  DISTRIBUTION 


Office  of  the  Secretary  of  Defense 

Assistant  Secretary  of  Defense  (Production  and  Logistics) 
Assistant  Secretary  of  Defense  (Force  Management  and  Personnel) 
Assistant  to  the  Secretary  of  Defense  for  Public  Affairs 
Comptroller  of  the  Department  of  Defense 

Department  of  the  Army 

Army  Audit  Agency 

Department  of  the  Naw 

Naval  Audit  Service 

Department  of  the  Air  Force 

Air  Force  Audit  Agency 

Defense  Agencies 

Director,  Defense  Commissary  Agency 
Director,  Defense  Contract  Audit  Agency 
Director,  Defense  Finance  and  Accounting  Service 
Director,  Defense  Logistics  Agency 

Director,  Defense  Logistics  Studies  Information  Exchange 
Inspector  General,  Defense  Intelligence  Agency 
National  Security  Agency 

Non-Defense  Federal  Organizations 

Office  of  Management  and  Budget 

National  Security  Division,  Special  Projects  Branch, 

Office  of  Federal  Procurement  Policy 
U.S.  General  Accounting  Office 

National  Security  and  International  Affairs  Division,  Technical 
Information  Center 

National  Security  and  International  Affairs  Division,  Defense 
and  National  Aeronautics  and  Space  Administration  Management 
Issues 

National  Security  and  International  Affairs  Division,  Military 
Operations  and  Capabilities  Issues 

Chairman  and  Ranking  Minority  Member  of  Each  of  the  Following 
Congressional  Committees  and  Subcommittees; 

Senate  Committee  on  Appropriations 

Senate  Subcommittee  on  Defense,  Committee  on  Appropriations 
Senate  Committee  on  Armed  Services 
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Non-Defense  Federal  Organizations  (cont'd) 

Senate  Committee  on  Governmental  Affairs 
House  Committee  on  Appropriations 

House  Subcommittee  on  Defense,  Committee  on  Appropriations 
House  Committee  on  Armed  Services 
House  Committee  on  Government  Operations 
House  Subcommittee  on  Legislation  and  National  Security, 
Committee  on  Government  Operations 
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PART  IV-  MANAGEMENT  COMMENTS 


Defense  Commissary  Agency 

Audit  Response  to  Specific  Defense  Commissary  Agency  Comments 


MANAGEMBTJT  COMMENTS;  DEFENSE  COMMISSARY  AGENCY 


defense  commissary  agency 

HiAOCuAflTgps 

FORTtEc  VIRG.MA  2J80»-630& 


ArnimoMor 


J997 


IB 


MEMORAHDUM  FOR 


IIISBFCTOR  GEIIERAl,  LOGISTICS  SUPPORT 
STRECTORATE ,  400  ARMY  NAVY  DRI’*'^ , 
"A  22202-2884 


ARLIIIGTOi: 


SUBJE 


Draft  Audit  Report  on  the  Controls  Over  Vendor  Payment 
Authorizations'  by  the  Defense  Commissar:.'  Agency 
(Project  No*  2I*A— 2 0 03 •  03  ) 


Rererence:  DoDIG  Memorandum,  dtd  April  23,  1995,  SAB- 

Per  your  request  in  referenced  memorandum,  atracned  are  our 
comments  to  the  recommendations. 


RICHARD  E.  3EAJ-E,  aTR. 
Ma j or  General ,  US*^ 
Director 


Attachment : 
AS  Stated 
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DEFENSE  COMMISSARY  AGENCY  REPLY 
DRAFT  AUDIT  REPORT 

SUBJECT:  Draft:  Audit  Report  on  the  Controls  Over  Vendor  Payment 

Authorizations  by  the  Defense  ComnLissary  Agency 
(Project  No.  2XJt-2003.03) 

Additional  Coanants:  The  following  additional  comments  are 

provided  to  the  craft  report. 

Executive  Summary  -  Introduction:  Estimated  sales  for  FY  1993  are 
$6.0  billion  versus  $6.7  billion. 

Executive  Summary  -  Potential  Benefits  of  Audit:  We  disagree  that 
the  $191  million  is  a  potential  monetary  benefit  as  stated  in  the 
report.  The  invalid  invoice  records  removed  from  the  bill  paying 
system  were  the  erroneous  invoices  that  the  service  centers  had 
corrected  for  the  venders  in  lieu  of  returning  invoices  to  the 
vendors.  This  cleanup  cf  the  invoice  data  base  was  not  due  to  the 
DoDIG  audit  but  was  part  of  the  process  to  matchup  DeCA  receipts 
with  vendors  invoices  in  the  bill  paying  system.  DeCA  was  aware  of 
the  invalid  invoice  records  in  the  bill  paying  system  and  would  not 
have  permitted  them  to  remain  there  and  possibly  be  paid  in  error. 

Part  I  -  Other  Matters  of  Interest:  After  a  trial  period,  DeCA 
discontinued  tne  edit  of  invoice  numbers  in  the  bill  paying  system 
because  of  the  excessive  processing  time  required  to  scan  records - 
Vendors  either  did  not  use  invoice  numbers  or  they  reused  them 
frequently  causing  excessive  outputs  to  review.  The  invoice  number 
is  not  a  mandatory  requirement  of  the  Prompt  Payment  Act  or  0MB 
Circular  A- 125.  Vendors  are  reluctant  to  change  their  billing 
systems  to  meet  a  special  DeCA  requirement.  For  example ,  DeCA  has 
been  criticized  by  Congress  for  offering  only  semi-monthly  rollup 
billing  periods  when  the  food  industry  uses  multiple  billing 
periods  (i-e.,  monthly,  weekly,  etc.).  Placing  special  invoice 
numoering  requirements  on  food  industry  vendors  will  be  viewed 
negatively  by  Congress  as  an  attempt  to  establish  additional 
payment  criteria  that  is  not  in  the  current  law  or  regulation. 

After  investigation  of  the  processing  delays  experienced  by 
the  West  Service  Center,  DeCA  determined  that  the  data 
communications  network  between  the  East  and  West  Service  Centers 
was  the  primary'  cause .  Improvements  were  made  in  the  data 
communications  network  tnat  resolved  the  prcolems  and  they  were 
more  cost  effective  than  establishing  a  second  computer  site  at  the 
West  Ser/ice  Center. 

Significant  efforts  taken  by  DeCA  to  improve  the  vendor 
payment  process  tnat  are  omitted  from  your  report  are: 
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-DeCA  provided  briefings  and  bill  paying  training  to  industry 
prior  to  Ocrooer  1991  and  has  continued  to  do  so  to  the  present 
time.  In  March  1991  DeCA  provided  industry  with  guidance  on  the 
concept  of  operations  to  include  bill  paying.  DeCA  transition  team 
memoers  appeared  at  American  Logistic  Agency  (ALA)  conferences  to 
present  the  DeCA  concept  of  operation  to  include  bill  paying.  The 
ALA  is  a  trade  association  of  vendors  involved  in  supplying 
commissary  resale  items.  Since  October  1,  1991/  bill  paying 
training  was  provided  by  DeCA  trainers  to  vendors  at  Longbeach/  CA, 
Washington/  Atlanta,  GA,  San  Antonie,  TX,  and  Seattle,  WA. 

-DeCA  prepared  a  detailed  bill  paying  guide  for  industry  that 
was  distributed  to  our  vendors  in  March  1992-  The  guide  reiterated 
the  bill  paying  instructions  that  were  provided  vendors  in  DeCA' s 
contracts;  it  provided  examples;  covered  prompt  pay  invoice 
reauirements ;  and  provided  points  of  contacts  at  DeCA  service 
centers  and  regions  to  resolve  bill  paying  problems.  The  guide  was 
updated  in  September  1992  and  reissued. 

-DeCA  developed  contract  matrixes  by  commissary  for  each 
vendor  to  assist  them  in  preparing  correct  invoices.  Initially, 
DeCA  issued  approximately  26,000  contracts  to  replace  the  over 
60,000  used  by  the  former  military  commissary  systems.  DeCA 
continued  to  refine  the  number  of  contracts  needed  and  has  reduced 
the  number  of  contracts  to  approximately  16,000.  Fewer  contracts 
reduces  the  risk  of  the  vendor  submitting  an  incorrect  invoice  for 
payment  - 

-DeCA  established  a  plan  to  assist  small  businesses  in 
resolving  bill  paying  problems.  A  small  business  ombudsman  was 
appointed  at  the  headquarters  to  oversee  implementation  of  the 
plan.  Small  business  ceils  were  established  at  the  DeCA  regions 
and  seirvice  centers;  commissaries  were  directed  to  contact  small 
business  representatives  visiting  their  stores  to  determine  if  they 
had  bill  payxng  problems  and  needed  assistance. 

-During  5T  1992,  DeCA  retrained  and  certified  commissary 
personnel,  who  were  involved  in  the  bill  paying  process,  to  ensure 
they  were  proficient  and  understood  the  procedures  for  ordering, 
receiving  and  inputting  receipt  data  to  z'ne  bill  paying  system- 

PART  II  -  A.  Vendor  Payment  Processing  Controls:  The  statement 
that  DeCA  did  not  adequately  communicate  contract  ntimuers  to 
vendors  is  not  factual,  and  we  tiave  not  seen  audit  evidence  which 
supports  the  statement.  DeCA  issued  ccntracts  to  vendors  which 
provided  not  only  contract  numbers  but  billing  instructions  and  the 
address  for  suemitting  invoices  for  payment.  The  majority  of 
contracts  were  issued  to  vendors  prior  to  October  1,  1991  with  an 
effective  date  for  ordering  of  October  1,  1991.  In  working  with 
venaors  to  resolve  bill  paying  problems  during  FY  1992,  we 
determined  that  many  vendors  did  not  read  their  contracts  although 
they  had  them.  One  national  supplier  determined  that  they  nad  not 
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canceled  a  prior  agreement  with  one  of  their  major  distributors  to 
invoice  DeCA  on  their  behalf.  The  national  supplier  and  their 
distributor  were  submitting  duplicate  invoices  to-  DeCA  for  the  same 
deliveries  for  over  6  months  into  FY  1992.  DeCA  determined  that 
the  edits  in  the  DeCA  bill  paying  system  had  rejected  the 
duplicates  and  they  were  returned  without  payment. 

The  audit  statement  that  DeCA  paid  Sll  million  in  duplicate 
payment  should  indicate  that  it  is  a  projection.  The  DeCA  service 
centers  have  only  identified  about  S3  million  in  duplicate  payments 
as  of  Mav  1993  where  the  vendor  was  paid  more  than  one  time  for  the 
same  delivery  of  items.  When  this  is  discovered r  DeCA  notifies  the 
vendor  to  submit  a  check  for  the  duplicate  payment.  If  a  vendor 
fails  to  make  the  refund,  the  amount  is  offset  from  a  subsequent 
payment  to  the  vendor. 

The  audit  estimate  of  S17  million  in  potential  duplicate 
cayments  is  overstated  based  on  our  research  of  the  data  from  the 
audit.  The  DeCA  West  Service  Center,  based  on  research  and 
identification  of  duplicate  payments,  estimates  about  30  percent  cr 
aoproximately  $7.6  million  of  duplicate  payments  may  have  been  made 
by*^  them.  The  DeCA  East  Service  Center  has  identified  under 
sio0,000  in  duplicate  payments  and  estimates  less  than  a  million 
will  be  identified  from  the  potential  list  of  duplicates. 

PART  II  -  Discussion  of  Details  (Pages  5,  7  and  9):  The  background 
statement  does  not  adequately  explain  to  the  reader  how  and  why  the 
svstems  were  selected  although  this  is  very  pertinent  to  an 
understanding  of  the  report.  Additionally,  on  page  7  the 
statements  on  the  testing  and  adoption  of  a  bill  paying  system  does 
not  accurately  state  what  happened  in  the  selection  of  SAVES  or  the 
time  available  for  testing. 

-The  DeCA  transition  team  reviewed  the  stock  fund  accounting 
and  bill  paying  systems  of  the  prior  commissary  systems  and  several 
used  by  tne” Defense  Logistics  Agency  rDLA)  to  select  one  for  DeCA's 
use.  The  results  of  those  reviews  were  as  follows: 

— The  Navy  and  Marine  Corps  requested  DeCA  not  consider 
use  of  their  accounting  systems  due  to  the  commitments  already 
placed  cn  the  systems . 

—The  Base  Operating  Support  System  (BOSS)  and  the 
Cefense  Integrated  Subsistence  Management  Information  System 
rCISMS)  were  reviewed  at  DLA.  The  BOSS  required  major  software 
cnanges  to  accommodate  commissary  accounting  and  bill  ^  paying 
requirements  that  could  not  be  accomplished  by  the  capitalization 
date.  The  f inancial/accounting  software  portion  of  the  DISMS  was 
not  due  to  be  completed  in  development  and  fielded  until  FY  199  3  . 

— The  Stock  Material  Accounting  System  ( SMAS )  used  by  the 
Air  Force  commissary  system  was  originally  selected  for  use  cy  DeCA 
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transi-tion  team.  The  SMAS  was  a  modern  stock  fund  accounting 
system  with  an  integrated  conunissary  bill  paying  system.  However^ 
the  systems  were  designed  to  operate  in  a  UNISYS  environment  and 
they  were  only  operational  at  base  level  with  one  or  two 
commissaries  per  system,  A  contractor  determined  in  Decemoer  1990 
that  the  time  to  convert  the  SMAS  to  an  IBM  type  environment  would 
be  aoDroximately  45  weeks  which  was  outside  the  consolidation 
window  of  October  1,  1991.  The  design  agency  for  SMAS  also  raised 
questions  whether  the  software  could  handle  the  volume  of 
commissaries  under  each  DeCA  region. 

-The  Army's  commissary  stock  fund  accounting  and  bill 
oaving  systems  (i.e.  STANFINS  and  SAVES)  were  selected  as  the  fall 
back  systems.  In  January  1991  t.he  STANFINS  was  stress  tested  by 
the  Defense  Information  Technology  Services  Organization  (DITSO), 
Indiana,  Financial  Systems  Division,  to  ensure  it  would  handle  the 
proTected  volume  of  DeCA's  stock  fund  transactions.  The  STAliFINS 
passed  the  stress  test.  The  ORACLE  contractor  supporting  the 
Army's  commissary  bill  paying  system  (SAVES)  developed  the 
recommended  computer  configuration  based  on  functional  analysis  and 
synthesis  of  the  projected  payments  for  DeCA.  Both  systems  were 
selected  as  a  package  because  the  interfaces  were  in  place  and 
would  allow  capitalization  by  October  1,  1991.  However,  cnanges 
were  made  to  the  STANFINS  to  accommodate  the  Air  Force  troop 
support  function  which  delayed  the  turnover  of  the  accounting 
system  for  DeCA's  use  until  Septemoer  16,  1991  which  prevented  any 
integrated  testing  of  the  business,  bill  paying,  and  accounting 
systems  prior  to  implementation.  The  late  receipt  of  accounting 
and  bill  paying  systems  by  DeCA  was  the  predominate  reason  for 
inaaequate  "integrated  systems  testing,  training  and  system 
documentation . 

PART  II  -  Written  procedures  for  processing  vendor  payments: 
Initially  the  Army's  bill  paying  procedures  were  used  by  the  DeCA 
service  centers  to  pay  bills.  The  DeCA  service  centers  were  opened 
in  tne  latter  half  of  FY  1991  to  ease  the  transition  to  one 
commissary  agency.  Starting  in  April  1991  they  began  to  take  over 
the  Army's  commissary  payments  and  in  July  1991  the  Navy's 
commissary  payments  were  phased  into  the  service  centers.  The 
Army's  bill  paying  system  f  SAVES )  and  procedures  were  in  use  for 
the  prior  5  years  and  were  in  compliance  with  0MB  Circular  A- 125 
and  the  Prompt  Payment  Act.  DeCA  revised  and  issued  the  bill 
paying  procedures  to  the  service  centers  in  March  1992  and  again 
after  they  were  received  from  printing  in  July  1992.  While  some 
personnel  did  not  have  the  proceaures  at  their  desks,  tney  were 
distributed  to  the  service  centers  and  were  available  to  the 
majority  of  personnel  to  include  supervisors  and  lead  examiners. 

PART  II  -  Invoice  data  ent^:  The  audit  report  statements 
regarding  invoice  numbers  implies  they  are  the  cause  for  aupiicate 
payments  which  is  not  accurate.  Invoice  numbers  are  not  a 
manaatory  requirement  of  the  Prompt  Payment  Act  or  0MB  Circular  A- 
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125*  The  DeCA  bill  paying  sysrem,  SAVES,  edits  the  contract 
ncinber,  order  number  and  comaissary  identification  number  (i,e-, 
DODAAC)  upon  entry  of  the  invoice  to  identify  duplicate  invoices. 
When  commissaxies  and/or  ser^.^ice  center  personnel  input  changes  to 
tne  contract  and/or  order  nuaoer  to  correct  errors  they  did  not 
always  delete  the  erroneous  record  from  the  bill  paying  system 
which  later  on,  in  some  instances,  was  erroneously  paid  a  second 
tune . 

In  instances  where  the  vendor ' s  contract  required  a  semi¬ 
monthly  rollup  invoice,  the  service  centers  added  the  vendor's 
invoices  where  they  were  net  summarized  as  required.  In  the 
startup  period,  the  seirvice  centers  corrected  rollup  invoices  and 
entered  them  in  the  bill  paying  system  to  ensure  prompt  payment  in 
lieu  of  returning  them  to  the  vendor  which  would  have  caused  longer 
payment  delays . 

PART  II  -  Receipt  data  entry:  The  last  sentence  in  the  paragraph 
snould  be  revised  as  follows : 

Delivery  documents  for  frequent  and  direct  store  deliveries 
were  not  being  retained  by  all  commissaries  for  the  required  6 
years  and  3  months,  as  required  by  DeCA  Directive  70-6. 

The  report  implies  that  all  commissaries  did  not  retain 
documents  as"  required.  The  report  should  state  how  many  instances 
were  found. 

PART  II  -  Personnel;  The  supervisory  span  of  control  for  voucher 
examiner  employees  of  15  is  adequate  for  this  type  of  a  function. 
We  agree  that  inadequate  staffing  and  training  of  personnel  were 
problems  in  the  service  centers.  This  occurred  for  the  following 
reasons-  Initially,  DeCA  service  centers  were  authorized  up  to  90 
overhires  each  prior  to  Octeoer  1,  1991  to  handle  the  phase  in  of 
the  DeCA  payments  and  the  phase  out  of  the  Army  and  Navy  commissary 
payments.  "  It  was  estimated  that  these  overhires  would  be 
eliminated  by  January  1992.  However,  the  magnitude  of  the  payment 
problems  caused  by  vendors  using  incorrect  contract  and  order 
numoers  to  prepare  invoices  or  not  preparing  rollup  invoices, 
coupled  with* system  and  communication  problems  to  get  receipt  data 
into  the  bill  paying  system  from  store  level,  overwhelmed  the 
service  center  staff.  DeCA's  reduced  funding  to  achieve  the 
mandated  savings  of  the  Jenes  Study  further  exaceroated  the 
situation  and  prevented  the  .tiring  of  additional  staff  until  the 
latter  part  of  FY  1992. 

PART  II  -  Commuaication  with  Vendors:  The  first  sentence  appears 
to  be  an  overstatement  and  not  adequately  supported  by  audit 
results.  DeCA  issued  contracts  to  venaors  prior  to  Octooer  1991 
which  included  detailed  billing  instructions  and  the  address  for 
submitting  their  invoices  for  payment.  As  discussed  earlier,  the 
DeCA  transition  team  providec  training  to  industry  on  the  concept 
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of  operations  to  include  bill  paying.  Additionally,  the  transition 
team  worked  with  members  of  the  AUV  to  develop  the  semi-monthly 
billing  procedures  used  by  DeCA.  Subsequent  to  consolidation,  DeCA 
provided  several  bill  paying  guides  to  industry  and  a  number  of 
training  sessions  around  the  United  States  which  are  above  and 
beyond  what  is  required  of  any  government  agency  engaged  in 
business  with  the  private  sector. 

Commissaries  were  provided  copies  of  DeCA  contracts  and 
contract  information  was  provided  via  the  automated  system  they 
used  for  ordering  and  inputting  receipt  information.  Serious 
software  problems  with  the  former  Air  Force  commissary  automated 
system  that  was  being  used  by  106  commissaries  required  that  all 
receipts  be  reentered  to  the  bill  paying  system  starting  in 
November  1991  through  March  1992.  This  significantly  added  to  late 
payments  and  entry  errors  which  were  not  due  to  lack  of  contract 
information  at  the  commissary  level.  DeCA  had  to  put  in  a  backup 
system  at  106  locations  to  replace  this  system  for  inputting 
receipts  to  the  bill  paying  system  during  this  period - 

PART  II  -  Subsequent  Actions:  As  previously  discussed,  based  on 
potential  duplicate  payments  you  ’identified,  the  DeCA  service 
centers  have  identified  approximately  $3  million  in  duplicate 
payments.  The  West  Service  Center  estimates  duplicate  payments  of 
$7.6  million  when  their  research  is  completed  in  Septemoer  1993. 
The  East  Service  Center  has  identified  less  than  5100,000  in 
duplicate  payments  to  date  and  estimates  less  than  SI  million  when 
they  complete  research. 

PART  II  -  B.  Adherence  to  the  Prompt  Payment  Act:  As  previously 
discussed  adequate  time  was  not  available  to  perform  extensive 
integrated  testing  of  business,  bill  paying  and  accounting  systems 
or  publish  formal  procedures  and  conduct  extensive  training  prior 
to  consolidation  October  1,  1991. 

Due  to  the  magnitude  of  incorrect  invoicing  by  vendors ,  DeCA 
service  centers  made  corrections  in  order  to  make  payments.  Our 
intentions  were  to  pay  vendors  as  promptly  as  possible  during  this 
turbulent  period  which  we  believe  is  the  underlying  philosophy  for 
the  Prompt  Payment  Act. 

PART  II  -  Proceasing  Delays:  We  believe  that  the  statement  that 
DeCA  service  centers  permitted  unprocessed  new  and  old  invoices  to 
literally  pile  up  in  mail  buckets  and  filing  cabinets  and  on 
voucher  examiners '  desks  is  an  overstatement  and  not  entirely 
factual  as  written.  The  DeCA  service  centers  receive  a  total  of 
approximately  11,000  invoices  daily  which  equals  to  about  7  days 
for  the  78,000  invoices  you  reported.  The  invoices  with  net  7  and 
10  day  due  dates  were  given  priority  fcr  input  to  the  bill  paying 
system  to  ensure  timely  payment.  A  7  day  delay  cn  inputting 
invoices  with  net  23  and  3  0  day  terms  did  not  necessarily  equate  to 
late  payments. 
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When  the  Prompt  Pay  Act  changed  the  requirements  to  compute 
the  discount  from  the  date  on  the  vendor's  invoice  rather  than  the 
date  the  invoice  was  received  in  the  paying  office,  many  discounts 
were  lost  due  to  the  mail  time  in  receiving  the  invoice  in  the 
paying  office.  Your  sample  should  have  shown  how  many  discounts 
were  lost  because  of  this  change  in  the  Prompt  Payment  Act. 

PAHT  II  *  Determination  of  due  dates;  The  last  paragraph  indicates 
that  DeCA  instructed  its  personnel  to  use  the  date  of  the  changes 
as  the  date  of  invoice  receipt  for  calculating  the  due  date.  DeCA 
headquarters  issued  no  guidance  to  the  service  centers  to  use  the 
current  date  when  correcting  invoices.  The  DeCA  General  Counsel 
conducted  an  investigation  of  these  allegations  and  determined  that 
there  was  much  confusion  among  voucher  examiners  on  what  date  to 
utilize  in  the  above  situation  but  the  entry  of  current  dates  on 
corrected  invoices  was  not  consistent  between  the  service  centers 
and  within  the  West  Service  Center, 

PART  II  -  Return  of  Improper  Invoices:  Previous  discussions 
address  DeCA's  purpose  in  correcting  vendors'  invoices  rather  than 
returning  them  during  the  period  of  the  audit.  This  section  should 
state  why  DeCA  chose  to  correct  invoices  rather  than  returning  them 
to  provide  a  balanced  account  of  the  situation  reported. 

DeCA  implemented  an  Invalid  Invoice  Tracking  System  in  the 
West  Service  Center  in  October  1992  and  the  East  Service  Center  in 
November  1992. 

APPERDIZ  A:  DeCA  questions  your  definition  of  duplicate  payments. 
We  believe  it  can  mislead  the  reader  into  believing  that  DeCA  paid 
multiple  times  for  the  same  item.  Your  definition  is  based  on  the 
same  invoice  (i.e.,  invoice  number)  being  paid  more  than  one  time 
by  the  DeCA  service  center. 

As  noted  in  the  audit  results ,  the  service  centers  corrected 
erroneous  contract  and/or  order  numoers  on  vendors'  invoices  to 
sustain  their  cash  flows  in  lieu* of  returning  them  which  would  have 
further  delayed  their  payments.  This  was  done  to  comply  with  the 
underlying  intent  of  the  Prompt  Payment  Act  which  is  to  pay  vendors 
without  delay.  In  many  cases,  as  noted  in  the  audit  report,  the 
old  invoices  were  not  deleted  in  SAVES  and  subsequently  were  used 
to  make  payments  on  another  of  the  vendor's  deliveries-  Although 
the  vendor's  invoice  number  would  be  the  same  on  both  payments  made 
by  the  service  center,  the  payments,  in  fact,  were  for  two 
different  deliveries  of  items  to  the  cammissary .  In  all  instances 
the  service  centers  paid  the  lower  amount  of  invoice  or  receipt 
amount  so  no  overpayments  were  made  to  the  vendor  when  two  separate 
deliveries  of  items  (i.a.  receipts)  were  paid  the  vendor  using  the 
same  invoice. 

DeCA  is  not  suggesting  that  paying  for  multiple  deliveries 
^i.e,  receipts)  using  tne  same  invoice  is  the  proper  way  to  do 
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business.  DeCA  is  as  concerned  as  you  nhat  this  has  happened  but 
we  cannot  undo  what  has  occurred.  The  service  centers  have 
identified  aoproximatelv  S3  million  in  true  duplicate  payments  of 
those  alleged  to  be  duplicates.  The  West  Service  Center  estimates 
they  made  approximately  $7.6  million  in  duplicate  payments 
primarily  because  they  were  paying  based  on  proof  of  delivery 
furnished  by  the  vendor.  The  East  Service  Center  has  identified 
less  than  $100,000  in  duplicate  payments  and  they  estimate  less 
than  $1  million  in  duplicates  will  be  identified  when  the  research 
is  completed-  Research  of  potential  duplicate  payments  will  be 
completed  by  September  30,  1993. 

DeCA  is  considering  using  a  contractor  to  review  payments  and 
identify  duplicate  payments  for  recoupment.  The  AAFES  and  NEXCOM 
use  contractors  to  review  their  payment  history  to  identify 
duplicate  payments  for  recoupment.  If  we  do  so,  we  plan  to  have 
the  contractor  begin  work  before  December  1993. 


REPLIES  TO  RECOMHEHDATIOHS 

Finding  A.  Vendor  Payment  Processing  Controls 

Recommendation  I .  Obtain  Standard  Automated  Voucher  Examination 
System  documentation  and  upgrade  automatic  data  processing 
capabilities,  by  increasing  computer  edit  checks,  and  documenting 
the  internal  controls  for  the  bill  paying  computer  system. 

Action  Taken.  Concur.  About  85  percent  of  the  ADP  documentation 
has  been  developed  for  SAVES.  The  additional  15  percent  is 
currently  being  developed,  to  include  flowcharts  for  receipt 
processing,  description  of  the  monthly  sequential  processing,  an 
operators  runbook,  and  a  data  element  cross  reference.  The  target 
date  for  completion  of  the  documentation  is  July  31,  1993. 
Documentation  will  continue  to  updated  and  maintained  as  programs, 
processes,  and  modules  change. 

Over  the  past  10  months,  enhancements  were  made  to  SAVES  data 
processing  capaiailities .  The  nightly  batch  cycle  processing  time 
has  been  reduced  from  10.5  hours  to  4.5  hours,  greatly  increasing 
system  availability.  Upgrades  to  the  contracting  modules,  to 
include  complete  audit  tracking,  fast-pay  module,  streamlined  DTI 
processing,  and  various  tracking  reports  have  been  implemented  to 
improve  controls.  Also  added  was  electronic  invoice  processing, 
saving  time  and  labor  and  resulting  in  a  more  error-free  input 
source.  Also,  hardware  and  software  upgrades  were  implemented, 
providing  better  performance  and  increased  storage  capacity. 

Edit  checks  of  the  invoice  number  were  stopped  by  DeCA  after 
initial  implementation .  DeCA  processes  approximately  10  percent  cr 
the  total  invoices  paid  by  the  Department  of  Defense.  With  this 
volume  of  transactions,  any  hardware  and/or  software  configuration 
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would  become  saturated  after  a  short  time.  The  full  implementation 
of  the  DeCA  Interim  Business  System  (DIBS)  will  further  ensure 
there  is  no  recurrence  of  the  contract  and  order  number  problems 
experienced  by  DeCA  in  the  first  half  of  FY  1992. 

Recommendation  2.  Place  all  financial  functions  under  the 
opera^xona-  control  of  the  Director,  Resource  Management. 

Action  Taken.  Concur.  All  finance  functions  have  been  placed 
under  the  control  of  the  Director,  Resource  Management  effective 
February’  1.  1993. 

Ri»cnTmnendation  3-  Establish  a  written  plan  for  evaluating, 
testing,  and  monTtoring  the  bill  paying  system. 

Action  Taicen.  Concur.  The  development  and  implementation  of  DeCA 
Directive  30-9,  Configuration  Management  for  Automated  Information 
Systems  /AIS),  March  12,  1993  together  with  the  active  involvement 
of  the  DeCA  Configuration  Control  Board  (CCB)  have  signif icantly 
enhanced  the  evaluation,  monitoring  and  control  of  SAVES  software 
changes  and  overall  system  operations-  DeCA  Directive  30-6, 
Automated  Information  Systems  (AIS)  Testing  Procedures,  February 
26,  1993,  prescribes  the  applicability,  objectives  and  policy,  and 
assigns  responsibility  for  the  planning,  execution  and  evaluation 
of  computer  software  testing  of  automated  data  systems  within  the 
DeCA  and  as  reauired  in  DoD-STD-2167A.  Since  the  draft  was 
released  in  June  1992,  testing  of  SAVES  has  conscientiously 
conformed  to  the  directive.  Subsequent  testing  of  software  release 
packages  has  involved  both  functional  representatives  from 
headquarters ,  service  centers  and  regions ,  and  the  system 
developers,  utilizing  test  plans  and  test  condition  requirements  to 
thoroughly  analyze  the  changes  to  the  system  and  all  interfacing 
svstems.  Test  analysis  reports  are  prepared  and  all  outstanding 
problems  resolved  before  the  test  cnairman  certifies  software  for 
release. 

Recommendation  4 .  Research  the  listing  of  FY  1992  potential 
duolicate  payments  provided  to  DeCA  and  take  action  to  recoup 
duplicate  payments. 

Action  Taken*  Concur.  The  possible  duplicate  payment  listing  is 
being  reviewed  by  a  dedicated  team  at  each  service  center,  and 
action  is  being  taken  to  collect  any  payments  not  authorized.  The 
service  centers  have  identified  approximately  S3  million  in 
duDiicate  payments  to  date.  The  West  Service  Center  estimates 
duplicate  pa\^ents  of  S7.6  million  when  their  research  is  completed 
in"  Septemoer  1993-  The  East  Service  Center  has  identified  less 
than  $100,000  in  duplicate  payments  to  date  and  estimates  less  than 
$1  million  when  they  complete  researc.h. 

Potential  Benefits  Resulting  from  Audit.  DeCA  could  recoup  up  to 
S17  miliicn  in  aupiicate  payments  to  vendors. 
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DeCA  Comments .  The  projecred  amount  of  benefits  resulting  from  the 
audit  appears  guescionabie -  We  agree  that  the  prevention  of 
duplicate  payments  (i.e,,  where  tne  same  items  are  paid  for  more 
than  one  time)  would  put  funds  to  oetter  use.  However,  based  on 
the  research  of  potential  dupitcate  payments  the  West  Service 
Center  projects  si.6  million  and  tne  East  Service  Center  projects 
less  than  $1  million  in  actual  duplicate  payments  to  be  recovered. 

Finding  B.  Adherence  to  the  Prompt  Payment  Act 

Recommendation  1.  Establish  controls  to  ensure  that  service 
center  nersonnel  meet  requirements  of  the  Prompt  Payment  Act. 

Action  Taken.  Concur,  DeCAD  70-10  provides  procedures  to  ensure 
Prompt  Payment  requirements  are  adhered  to  for  payments  to 
commercial  vendors.  Service  center  personnel  were  trained  on  these 
procedures  in  May  1992.  In  addition,  a  special  headquarters 
Resource  Management  team  reviewed  service  center  bill  paying  and 
trained  oersonnei  during  the  period  September  1992  through  Marcn 
1993. 

Recommendation  2 .  Maintain  automated  records  in  the  Standard 
Automated  Voucher  Examination  System  to  distinguish  between 
original  invoice  submissions  and  corrected  invoice  submissions. 
Additionally,  develop  a  feature  to  record  and  track  invoices 
returned  to  vendors  and  resubmitted  for  payment. 

Action  Taken.  Concur.  The  Invalid  Invoice  Tracking  System  ( IITS ^ 
was  aeveioped  and  released  to  the  service  centers  in  October  and 
Novemoer  1992  as  an  automated  off-line  method  of  tracking  invalid 
invoices.  This  system  records  invalid  invoices  returned  to  the 
vendor,  and,  upon  resubmission  of  the  invoice,  provides  an  adjusted 
date  for  payment  purposes,  to  meet  Prompt  Payment  requirements . 
The  system  identifies,  by  reason  codes,  the  errors  causing  the 
invoice  to  be  invalid,  provides  the  vendor  this  information  and  the 
corrective  action  needed  when  the  invoice  is  returned. 

DeCA  is  working  toward  incorporating  the  tracking  of  returned 
invoices  into  SAVES.  The  first  step  to  incorporate  tracking  was 
initiated  with  the  implementation  of  EDI  invoicing.  When  an  EDI 
invoice  is  not  inserted  into  SAVES  data  base,  it  is  assigned  a 
reason  code .  These  reason  codes  are  based  on  criteria  that 
identifies  why  an  invoice  should  be  returned-  SAVES  maintains  a 
table  of  the  invoice  records  that  have  been  rejected  with  all  the 
data  transmitted  and  the  reason  code  of  why  it  was  rejected. 
Projected  date  for  this  SAVES  enhancement  to  be  completed  is  July 
1994  after  DIBS  full  deployment. 

Potential  Benefits  Resulting  from  Audit.  Undeterminable. 

DeCA  Cornments.  Concur.  Monetary'  benefits  are  undeterminable. 
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Audit  Response  to  Significant  Management  Comments 


The  following  paragraphs  summarize  the  significant  management 
comments  and  provide  audit  responses  to  those  comments.  The 
comments  and  response  are  presented  in  the  same  sequence  as  the 
full  text  of  management  comments.  The  subheadings  are  those  used 
by  management. 

PART  I  ~  Other  Matters  of  Interest. 

DeCA  comments.  The  Director,  DCA  stated  that  after  a  trial 
period,  DeCA  discontinued  the  edit  of  invoice  numbers  in  the  bill 
paying  system  because  of  excessive  time  to  scan  records.  The 
Director  also  stated  that  the  use  of  invoice  numbers  is  not 
required  by  the  Prompt  Payment  Act. 

Audit  response.  We  agree  that  the  edit  of  invoice  numbers  is  not 
required  by  the  Prompt  Payment  Act.  Our  concern  is  that  the 
SAVES  does  not  include  sufficient  edit  checks  to  preclude 
duplicate  payments  as  shown  by  DeCA's  experience.  The  use  of 
invoice  number  is  one  of  many  possible  checks.  The  use  of 
invoice  numbers  is  a  common  business  practice  and  an  edit  check 
using  invoice  numbers  would  be  a  meaningful  internal  control. 
However,  other  information  could  be  used  to  perform  edit  checks 
for  erroneous  invoices.  Comparisions  of  contract  data,  receipt 
and  invoice  dates,  or  dollar  amounts  are  a  few  of  the  many 
possible  edit  checks. 

PART  II  -  A.  Vendor  Payment  Processing  Controls. 

DeCA  comments.  The  Director,  DeCA,  said  the  statement  in  the 
report  that  DeCA  did  not  adequately  communicate  contract  numbers 
to  vendors  is  incorrect.  The  Director  said  that  DeCA  issued  the 
majority  of  contracts  to  vendors  prior  to  October  1,  1991,  which 
provided  not  only  contract  numbers  but  billing  instructions  and 
the  address  for  submitting  invoices  for  payment. 

Audit  response.  DeCA  did  not  adequately  communicate  the  contract 
numbers  to  vendors  because  it  provided  more  contracts  than 
required  and  communicated  the  contract  numbers  in  a  manner  that 
the  vendors  were  unable  to  comprehend  and  to  use  for  preparing 
invoices.  DeCA  initially  issued  approximately  26,000  contracts 
to  vendors  and  later  reduced  the  number  of  contracts  to  16,000. 
Issuing  only  the  number  of  contracts  needed  would  have  reduced 
the  risk  of  a  vendor  submitting  an  incorrect  invoice  for  payment. 
Because  DeCA  originally  issued  more  contracts  to  vendors  than 
required,  vendors  were  confused  about  which  contract  to  use  in 
billing  for  deliveries.  Vendors  were  also  confused  because 
different  types  of  deliveries  to  the  same  commissary  required  the 
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use  of  different  contracts.  To  resolve  the  confusion,  DeCA 
developed  contract  matrices,  by  commissary,  for  each  vendor, 
which  assisted  vendors  in  preparing  correct  invoices. 

DeCA  comments.  The  Director,  DeCA  stated  that  the  statement  in 
the  report  that  DeCA  paid  $11  million  in  duplicate  payments 
during  the  first  half  of  FY  1992  should  be  modified  to  indicate 
that  the  $11  million  is  a  projection.  DeCA  has  identified  only 
$3  million  in  duplicate  payments  as  of  May  1993.  The  Director 
also  stated  that  the  service  centers  have  estimated  the  total 
duplicate  payment  to  be  about  $8.6  million  [for  FY  1992]  compared 
to  the  identified  monetary  benefits  of  $17  million. 

Audit  response.  The  report  has  been  clarified  to  indicate  that 
the  $11  million  is  a  projection.  The  DeCA  response,  however, 
erroneously  implies  that  DeCA  is  estimating  that  there  will  be 
about  $8.6  million  in  duplicate  payments  based  on  a  listing  of 
duplicate  payments  that  contains  $17  million  in  duplicate 
invoices.  The  DeCA  estimate  of  $8.6  million  is  based  on  a 
listing  we  provided  that  contained  about  $11  million  in  duplicate 
payments.  The  list  covered  the  period  from  October  1,  1991, 
through  March  26,  1992.  The  $8.6  million  is  within  the 
confidence  intervals  of  the  point  estimate. 

PART  II  -  B.  Adherence  to  the  Prompt  Payment  Act. 

DeCA  comments.  The  Director,  DeCA,  stated  that  the  intent  was  to 
pay  vendors  as  promptly  as  possible,  which  DeCA  believes  is  the 
underlying  philosophy  of  the  Prompt  Payment  Act.  Due  to  the 
magnitude  of  incorrect  invoices  submitted  by  vendors,  DeCA's 
service  center  personnel  made  corrections  in  order  to  make 
payments . 

Audit  response.  DeCA  did  not  comply  with  the  requirements  of  the 
Prompt  Payment  Act.  DeCA  was  required  to  pay  vendors  promptly 
and  maintain  adequate  internal  controls.  DeCA  did  not  use 
correct  due  dates  for  determining  interest  payments,  return 
improper  invoices  to  vendors  for  correction,  and  develop  and 
apply  a  reliable  system  of  internal  controls  for  processing 
invoices  for  payment.  The  magnitude  of  incorrect  invoicing  by 
vendors  was  caused  by  DeCA's  inadequate  communication  of  contract 
information  to  vendors. 

Processing  Delays 

DeCA  comments.  The  Director,  DeCA,  stated  that  the  statement  in 
the  report  that  service  centers  permitted  unprocessed  invoices  to 
literally  pile  up  in  mail  buckets  and  filing  cabinets  and  on 
voucher  examiners'  desks  is  an  overstatement  and  not  entirely 
factual.  The  service  centers  receive  approximately 
11,000  invoices  daily,  which  equals  about  78,000  invoices  in  a 
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7 -day  period.  The  Director  contended  that  a  7 -day  delay  in 
processing  invoices  with  a  net  23  or  3  0-day  term  did  not 
necessarily  equate  to  late  payments. 

Audit  response.  We  observed  invoices  in  the  service  centers 
literally  piled  up  in  mail  buckets  and  in  filing  cabinets  and  on 
voucher  examiners'  desks.  The  78,000  invoices  reported  was  an 
estimate  based  on  cubic  volume  of  invoices  observed  (auditors 
could  not  possibly  count  the  number  of  unprocessed  invoices  at 
that  time.)  Additionally,  all  the  unprocessed  vendor  invoices  in 
the  service  centers  were  not  in  view  for  the  auditors  to  observe. 
Some  of  the  observed  invoices  were  received  almost  30  days  prior 
and  had  not  been  entered  into  the  bill  paying  system. 

Determination  of  Due  Dates 

DeCA  comments.  The  Director,  DeCA  disagreed  with  the  statement 
in  the  report  that  DeCA  instructed  its  personnel  to  use  the  date 
of  DeCA  changes  as  the  date  of  invoice  receipt  for  calculating 
the  due  date.  The  Director  stated  that  DeCA  headquarters  issued 
no  guidance  to  service  centers  to  use  the  current  date  when 
correcting  invoices. 

Audit  response.  We  did  not  state  that  DeCA  headquarters  issued 
guidance  requiring  the  use  of  the  current  date  for  calculating 
the  due  date  and  any  interest  due  the  vendor.  We  were  told  by 
voucher  examiners  that  service  center  managers  told  them  to  use 
the  current  date.  This  has  been  confirmed  by  congressional 
testimony  and  concurrent  IG  investigations. 

APPENDIX  A 

DeCA  comments.  The  Director,  DeCA,  stated  that  the  IG,  DoD, 
definition  of  a  duplicate  payment  could  mislead  the  reader  into 
believing  that  DeCA  paid  multiple  times  for  the  same  item.  The 
Director  stated  that  the  IG,  DoD,  definition  of  duplicate 
payments  was  based  on  the  same  invoice  (that  is,  invoice  number) 
being  paid  more  than  one  time  by  a  service  center.  The  Director 
agreed  that  DeCA  corrected  invoice  entries  and  reentered  the 
invoice  data  into  the  bill  paying  system  although  the  original 
invoice  data  entries  were  not  deleted.  Service  center  personnel 
used  the  prior  invoice  entries  to  make  payments  on  another  of  the 
vendor's  deliveries.  Although  the  vendor's  invoice  number  would 
be  the  same  on  both  payments,  the  payments  were  for  two  different 
deliveries  to  the  commissary.  In  all  instances  the  service 
centers  paid  the  lower  of  invoice  or  receipt  amount  so  no 
overpayments  were  made  when  two  separate  deliveries  of  items  were 
paid  the  vendor  using  the  same  invoice.  The  Director  also  stated 
that  DeCA  is  not  suggesting  that  paying  for  multiple  deliveries 
(that  is,  receipts)  using  the  same  invoice  is  the  proper  way  to 
do  business. 
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Audit  response.  DeCA  did  make  multiple  payments  on  the  same 
invoice,  often  for  the  same  delivery.  The  IG,  DoD,  determined 
that  DeCA  made  duplicate  payments  because  DeCA  modified  and 
reentered  data  for  invoices  and  receipts  without  deleting  the 
original  entries.  The  IG,  DoD,  defined  duplicate  payments  in 
cases  where  multiple  vendor  payments  were  made  on  the  same 
invoice  as  the  chronologically  second  and  subsequent  such 
payments.  The  ongoing  effort  by  DeCA  to  identify  about 
$8.6  million  in  duplicate  payments  supports  our  statement  that 
multiple  payments  were  made  on  the  same  invoice  for  the  same 
delivery. 

The  Director  mentioned  the  practice  of  paying  the  lower  amount  of 
invoice  or  receipt  when  paying  vendors  using  the  same  invoice  for 
different  receipts.  DeCA  used  that  practice  instead  of 
reconciling  differences  between  invoice  amounts  and  receipt 
amounts  in  excess  of  a  dollar  threshold.  Paying  the  lesser  of 
invoice  or  receipt  is  an  example  of  the  breakdown  of  internal 
controls  that  permitted  duplicate  payments  to  occur.  Such 
breakdown  makes  the  accuracy  of  DeCA's  accounting  records 
suspect. 
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